Privy Labs

Web Development | SEO Specialist | Digital Advertising | Red Team

[vx-underground @vxunderground]

Did your slop Python script accidentally transfer $10,000,000 to a stranger?

Did your vibe coded app accidentally leaked 300,000 peoples phone numbers, e-mail addresses, and passport?

Don't worry, fam. The folks over there at ... Corgi ... now provide AI insurance.

[Tom Jøran Sønstebyseter Rønning @L1v1ng0ffTh3L4N]

Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.

[tuxsudo @tuxpizza]

This is great news.

Major carriers (at least in the US) already support RCS Universal Profile 3.0, which added an E2EE standard.

So not only will your iMessages be E2EE, but your chats to existing RCS Android users will now be as well. (And vice versa)

[Axel Bitblaze 🪓 @Axel_bitblaze69]

if you're using claude code and doing experiments on a day to day basis then be careful

hackers are creating hundreds of fake github repos disguised as legit tools.. crypto bots, trading tools, ai utilities, telegram bots.. polished readme files. ai generated documentation. real looking star counts..

you clone it. run npm install. and it's over.

a campaign called gitvenom alone created 200+ fake repos. one victim lost 5 btc.. $485,000 from a single clone.

what the malware does silently:

> it steals every password saved in your browser
> grabs your crypto wallet keys and seed phrases
> copies your ssh keys, github tokens, api credentials
> installs a "clipper" that swaps wallet addresses when you copy paste… you think you're sending to your own wallet but you're sending to theirs
> packages everything into an archive and sends it via telegram to the attacker

you won't even know it happened until your wallet is empty..

And also,

when you clone a repo and open claude code in that directory it reads the project files.. claude.md, .claude/ folder, settings.json, hooks, mcp configs.

attackers are now weaponizing this. a malicious claude.md file can:

> instruct claude to run hidden shell commands that look like a normal build process
> exfiltrate your ssh private keys, aws credentials, api keys, env secrets
> bypass claude code's deny rules entirely by chaining 50+ subcommands.. the safety system breaks after the 50th command and stops checking
> leak your anthropic api key before you even see a trust prompt

protect yourself.. save this checklist. before cloning any repo:

> check the repo age.. was it created this week? red flag
> check contributors.. is it one anonymous account? red flag
> check stars vs age.. 500 stars on a 2 day old repo? fake
> read the code before running anything. especially package.json scripts, postinstall hooks and any shell scripts
> google the repo name + "malware" or "scam" before cloning

and please never keep crypto wallets on the same machine you use for cloning random repos. use a hardware wallet. always.

[Charles Floate 📈 @Charles_SEO]

The LEAD search engineer at Google just dropped a brand new blog post that confirms something most SEOs have never even heard of...

Googlebot only fetches the first 2MB of your pages HTML = Everything after that cutoff doesn't exist to Google!!!

Not fetched, not rendered, not indexed.

And the Web Rendering Service is completely STATELESS - Meaning it clears local storage and session data between every request, so if your content depends on cookies or session state to render, Google can't see it.

External CSS and JS files are fetched SEPARATELY with their own 2MB limit per file, and PDFs get a 64mb limit.

So the structure and order of your code literally matters! And is why some CMSs are so much better out the box than others... Make sure you put your meta tags, title, canonicals, and structured data as HIGH as possible in the document. If they're below the 2MB cutoff, Google doesn't know they exist.

Most OnPage SEO guides never take any of this into account, but most OnPage is surface-level.

The real edge is understanding the infrastructure your content passes through before Google even evaluates it.

[Disclose.tv @disclosetv]

JUST IN - U.S. Cybersecurity and Infrastructure Security Agency quietly purchases "https://t.co/ijZjwdSJzg" domain name.

[GrapheneOS @GrapheneOS]

We're happy to announce a long-term partnership with Motorola. We're collaborating on future devices meeting our privacy and security standards with official GrapheneOS support.

https://t.co/8flkjD52Eg

[Globe Observer @_GlobeObserver]

🚨BREAKING: Google has agreed to pay $68 million for allegedly secretly listening to its users.

[OpenAI @OpenAI]

In the coming weeks, we plan to start testing ads in ChatGPT free and Go tiers.

We’re sharing our principles early on how we’ll approach ads–guided by putting user trust and transparency first as we work to make AI accessible to everyone.

What matters most:
- Responses in ChatGPT will not be influenced by ads.

- Ads are always separate and clearly labeled.

- Your conversations are private from advertisers.

- Plus, Pro, Business, and Enterprise tiers will not have ads.

[Privy Labs @privylabs]

@9to5mac @benlovejoy Anything but fixing iOS bugs I guess

[Alessia Sannazzaro @ale_sannazzaro]

Don't use the H Tag to style your headings! ✋Tags are used for structure and accessibility. Styling is used for visual effect. Don't confuse the two!

[Jampzey @Jampzey]

today I learned

[Barry Schwartz @rustybrick]

Lead for Chrome Developer Relations at Google is complaining about his site not showing up in Google Search https://t.co/lcGOwnkO4e

[Brodie Clark @brodieseo]

The time has come. Google is now showing ads within AI Mode for the first time ever.

Similar to the ads that I had originally spotted showing within AI overviews earlier this year, the placement is at the bottom of the response.

And as you can see, the ad results are labelled with the 'sponsored' tag, appearing in a similar way to the organic link cards directly above.

This was first spotted by @gsterling yesterday for a service-based query, and I've now been able to replicate it. Interestingly, the example Greg spotted was within the labs interface (signified with the beaker icon), but my example shows that it also displays outside of this experimental interface.

Google has been briefing brands on a Q4 rollout, according to reporting on @sengineland in August, with the rollout looking like it has now arrived in a formalised format. It will be interesting to see if the ad placement becomes integrated in the middle of the answer output, also, like we see within the main section of search results.

So, Ads within AI Mode are here. This marks a significant difference between Google's AI Mode and the likes of ChatGPT, with ChatGPT not having even close to the same infrastructure for ads as Google does, with the ChatGPT rollout of ads being one that is also looming and has been spotted by some within recent weeks.

More details on this experiment can be found within the comments. Make sure to subscribe to my monthly newsletter 'SERP Alert' if you haven't already, where I'll be giving a breakdown of major SERP feature changes on Google over the past month.

[Privy Labs @privylabs]

@rustybrick Looking at my ranking reports this morning and it’s not all bad. What I do see is volatility is increasing in terms of frequency. We use to weeks to months in between and now I’m seeing it weekly 🤷🏻‍♂️

[Marques Brownlee @MKBHD]

Pretty sick sick new feature that I am specifically excited about: Android update that makes Quick Share work with Airdrop. So you can easily share files/images between Android phones and iPhones (starting with Pixel 10)

https://t.co/AVCq2bZ9Hs

[Dave Jones @eevblog]

IMPORTANT message for everyone using Gmail.
You have been automatically OPTED IN to allow Gmail to access all your private messages & attachments to train AI models.
You have to manually turn off Smart Features in the Setting menu in TWO locations.

Retweet so every is aware.

[Proton Mail @ProtonMail]

quick reminder to disable all of these

[Disclose.tv @disclosetv]

MORE - Weidel: The planned EU regulation "overrides the end-to-end encryption of digital messages and makes it possible to automatically search all private messages, images, and videos on users' end devices. In other words, every citizen is placed under general digital suspicion and declared a potential criminal. Data protection, freedom of speech and opinion, privacy would thus finally become historical relics."

[The Hacker News @TheHackersNews]

🚨 U.K. just ordered Apple to break iCloud encryption.

The target? Every Briton’s backups.

Officials want far more than just disabling Advanced Data Protection—secret orders demand access to entire categories of iCloud data.

How deep does this go? ↓ https://t.co/7SR4FcM2L9

#threatsday #cybersecurity