news

news

Earning Cybersecurity Certifications in the US, Stage by Stage: Exams, Exam Fees and Study Costs (October 2026)

A roadmap for earning cybersecurity certifications in the US in three stages (entry, practitioner, advanced), with exam fees and study costs from each organization's official pages. Exam fees alone run from $199 to $439 at entry level and $544 to $1,699 at the top. Study costs range from free to about $8,800.

An Adobe Commerce and Magento Flaw Joins CISA's Exploited List: Fixed in July, Attacked Since March, and What to Check

On October 27 the US CISA added a file-upload flaw in Adobe Commerce and Magento (CVE-2026-48356) to its exploited list. The fix shipped on July 14, but attacks were reported from March. This article sorts out where to check, including why a version with a latest '-p' number is still affected.

15 Jenkins Core Flaws: Only One Works Without Login, but Some Need Nothing More Than Read Access

On October 28 the Jenkins project published fixes for 15 flaws in Jenkins core: 13 rated High and 2 Medium. Only one can be exploited without logging in, but some need nothing more than read access, and some can lead to remote code execution. I could not confirm any exploitation. Built on the official advisory: how far the headlines hold, and what to check now.

A Severity 9.8 Linux Kernel Flaw: What the AI-Built Attack Needs, and Where Each Distribution Stands

Anthropic demonstrated an attack on a flaw in the Linux kernel's IPv4 TCP code (CVE-2026-98432) that runs commands as root without authentication. The severity is 9.8. But the demonstration was a lab result under specific conditions (an MPTCP listener). The kernel is fixed upstream, while Ubuntu and others have no fixed kernel yet. Based on primary sources: the conditions, and where each distribution stands.

Two Critical GitLab Flaws, Not One: Why the October 12 Fix Is Not Enough

A flaw in how GitLab handles regular expressions in CI/CD configuration lets an unauthenticated attacker run code on the server. It was added to CISA's Known Exploited Vulnerabilities catalog on October 29. A second critical flaw of the same kind came out nine days after the first, and the first fix does not cover it. The real fix is in Ruby, so updating GitLab alone does not always work. Based on primary sources.

Where PHP2Shell Reports and the Primary Sources Disagree

Firewalls were compromised using the PHP2Shell flaw. That is true. But some headline numbers, and the claim that AI wrote the attack, do not match the primary sources. Using the original reports from Palo Alto, Dream, JPCERT/CC and CISA, this separates what is confirmed from what is not.

The Brotli Vulnerability Is Not Just a Node.js Problem: Where to Check and What Is Known About Exploitation

A vulnerability in the Brotli compression library was added to CISA's Known Exploited Vulnerabilities catalog on October 27. It became known through Node.js, but the flaw sits in a library that Node.js bundles, and it reaches .NET, Python, firewalls and more. Based on primary sources, here is where to check, and how firm the evidence of exploitation is.

A Planted Instruction File in the Downloads Folder Can Hijack AI Coding Agents: What Forever Security Found, and What to Do Now

Security firm Forever Security says it found, in the Downloads folder of a customer's machine, an instruction file (AGENTS.md) built to make an AI coding agent do something malicious, and reproduced the attack on OpenAI Codex and Claude Code. Based on the original post, here is what is confirmed, how to read the numbers, what is still unknown, and what to check now.

Haven't Updated PHP Yet? Where PHP2Shell Stands and What to Check Now

On October 26, CISA confirmed that the critical PHP vulnerability PHP2Shell is being exploited. Yet only about a quarter of the PHP in the world is on a fixed version. Here is how many have not updated, and what to check on your own site, step by step.

The Days When "Made with AI" Impressed People Are Over

More and more people post AI-made images and videos on social media. Some of it is cringe, and some of it is interesting even when you know AI made it. Here is what I think separates them.

Breaches of Member Systems Keep Coming: What the Disclosed Incidents Have in Common, the Methods JPCERT/CC Describes, and What to Check Now

From September into October 2026, unauthorized access to member and app systems was disclosed one after another, at Times Car, Yakiniku King, Lawson, Burger King, GMO Research & AI and others. This is a summary, built on primary sources, of the disclosed facts, the five methods in JPCERT/CC's advisory, and what operators should check now.

VPNs, Email Gateways and Remote-Support Tools: The Edge Devices Exploited This Month, and What to Check Now

In October 2026, exploitation was confirmed for Ivanti, Citrix, Palo Alto, Cisco, Fortinet, BeyondTrust and Japan's SiteGuard, all devices that sit at the edge of a network. This is a summary, built on official sources, of which devices are affected, what to do before you update, and what the Digital Agency incident shows.

Node.js Fixes 10 Vulnerabilities (CVE-2026-111497 and More): A Technical Summary for Engineers on the October 21, 2026 Security Release

On October 21, 2026, Node.js shipped a security release fixing 10 vulnerabilities (4 High, 3 Medium, 3 Low). This summary covers the most serious one, a remote code execution bug in the Brotli decoder (CVE-2026-111497), three TLS hostname-verification bypasses, what it means for 20.x and 25.x, and how to update, anchored in the official Node.js sources.

PHP's Critical PHP2Shell Vulnerabilities (CVE-2026-109618 / 109619): A Technical Summary for Engineers [Updated Regularly]

On October 21, 2026, PHP shipped fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS v4 9.2) that can lead to unauthenticated remote code execution. This is a summary built around the official advisories: affected versions, how to check, interim mitigations, exploitation status, and how much of what's being reported can be trusted.

As Breaches Mount in Japan, What Leaders Should Decide First: Zero Trust and Security in the Age of AI

In October 2026, a wave of data breaches in Japan prompted urgent notices to executives from IPA, METI and others. Here is what is happening, what zero trust actually means, how to think about AI security, and what to do this week, this month and this quarter, based on official sources.

The Floor Is Right. So Is the CEO. Why AI Adoption Comes Down to the CEO's Feel for AI

In almost every AI project, the floor and the CEO tell us opposite things — and both are right. That makes the final call a management decision, and the quality of that decision depends on the CEO's own hands-on feel for AI.

What Comes After AI Adoption: Using AI from a Business Workflow Perspective

As AI adoption continues to grow, the key question for businesses is shifting from “which tool to use” to “how to integrate AI into actual operations.” This article introduces an approach to designing AI utilization and automation that fits each company by organizing business workflows, data, and human decision-making without depending on a specific AI service.

From Adapting Operations to SaaS, to Building Systems Around the Way You Work

From an era of adapting operations to SaaS, to an era of building systems around your own business workflows. This article explains how companies can use AI, cloud technologies, and APIs to organize and automate manual, fragmented, and person-dependent workflows.

Who Can Actually Implement AI in the Real World? — 7 Reasons Super Sonic Design Is Chosen

While AI adoption is advancing, many companies still struggle to integrate it into real business operations. This article outlines how an “implementation-driven design company” bridges that gap through seven practical use cases.

At the Intersection of EC and AI: Personalization × RAG × ChatBot — A New UX Era for Shopify

In 2025, e-commerce is entering a new phase in which AI is reshaping everything from search experiences to site navigation. Even among Shopify-based businesses, the limitations of traditional UX are becoming apparent, and more advanced customer experiences are now expected. As UI optimization alone is no longer sufficient, this article introduces the latest approaches to delivering UX that instantly responds to user intent.

Headless eCommerce Trends and Practical Examples Using Sanity

Headless commerce separates the frontend and backend, enhancing flexibility and update speed. The market is growing rapidly, and Sanity case studies have already demonstrated its effectiveness. While costs and architectural considerations are important, it is an increasingly attractive option in markets that prioritize user experience.

Are People Really Not Interested in AI-Generated Content? A Perspective from New York

Why does AI-generated content often fail to resonate? From New York’s cultural lens and new surveys, we explore why people still value the human touch.

AI Slop Culture and the Future of Creativity

AI slop—mass-produced, shallow content generated by algorithms—is flooding social feeds. While it grabs attention, it also threatens creativity, originality, and meaningful storytelling.

The New Era of AI-Driven Browser Wars and the Redefinition of the Web

In the AI era, the browser is shifting from a tool for people to an entry point where AI delivers answers. We design the next-generation web by creating information architectures trusted by AI and experiences that resonate with people.

New York’s Focus on WebAssembly (WASM)

WebAssembly (WASM) is bringing app-level speed and power to the web—discover why New York is paying attention.

WordPress vs. WebFlow - What's the Best Choice

In website development, choosing the right CMS is crucial. Here, we provide an in-depth comparison of WordPress, widely used across the industry, and Webflow, which has been rapidly gaining popularity in recent years, across seven key criteria.

Web Accessibility Basics: Responding to ADA Lawsuits

Lawsuits over website accessibility under the ADA (Americans with Disabilities Act) are increasing, and their details are growing more complex. Many Super Sonic Design clients ask us how to make their websites accessible.

Is WordPress Dangerous? 7 Reasons Why High Hacking Risks Make It Hard to Recommend

When launching a website, many businesses and individuals first consider WordPress. However, behind its convenience and customization lies significant security risks that cannot be overlooked. Since the beginning of 2024, there have been continuous reports of WordPress sites falling victim to hacking incidents. As a result, our company has decided not to recommend using WordPress for future projects.

Want to Relax in New York? Recommended Sauna Guide Summer 2024

In the vicinity of New York, there are spas from around the world where you can easily experience a refreshing change of pace and relaxation. Let’s wash away your daily fatigue and stress along with your sweat. Here are five recommended sauna-related facilities that you can casually visit in the New York area.

7 Advantages and 5 Disadvantages of Using WordPress

In this article, we will introduce the advantages and disadvantages of using WordPress. Please watch the explanatory video about the seven great benefits of WordPress and the five drawbacks that can become problematic!

How to Create a Website in America: Top 3 Latest No-Code Recommendations

I will introduce three no-code development tools that can be used without programming knowledge. I will provide a detailed explanation of the features and advantages of Webflow, Notion, and Carrd, and suggest ways to utilize each one.

5 Recommended Platforms for Starting an E-Commerce Site in the U.S. (Beginner Edition)

I will list five platforms that beginners can consider when launching an e-commerce site in the U.S. and explain their advantages and disadvantages.

20 Recommended Locations for Photography in NYC: From Location Scouting to Weddings

New York is a great place to take pictures, and there are plenty of places that have been set in movies and TV shows. No matter where you cut out of the city, New York is picturesque. Among them, I've put together a list of the most recommended photo spots.

5 services to create a website for free

This article reviews five user-friendly website builders: Wix (easy but limited), SQUARESPACE (stylish but complex), Weebly (integrates with Square, some limitations), Bubble (great for web apps), and Carrd (simple one-page sites). Effective content organization is key to engaging users and driving purchases.

Unable to Receive Notification Emails from Asana.com? Here’s How to Solve It!

This time, I will share solutions for the issue of not receiving notification emails, which is one of the essential features of Asana for team projects.

Create Gantt Charts Easily and for Free with Instagantt & Asana!

You Need to Create a Gantt Chart! When it comes to larger projects, managing them becomes essential. In such cases, using project management software like Asana and Instagantt allows you to create Gantt charts easily and for free, so let me introduce how to do that!

Solving Problems with RingCentral (formerly Glip) Internal Chat!

Discover how to solve internal communication challenges with RingCentral (formerly Glip) in our latest YouTube video. Learn why this free chat app is a great alternative to Slack, especially for teams needing to retain chat history. Join Super Sonic Design as we share valuable insights for small global businesses!

We have launched a new website!

Today, we are excited to announce that we have revamped our company's website. Given that we are a company that develops websites and applications, it was

43 W 33rd St, #202, New York, NY 10001
Phone: +1 (848) 281-7853
Email: info@supersonicdesign.com

newsAboutContact usJAPANESE
Copyright © 2024 SUPER SONIC DESIGN INC.