GoKawiil
Tech News
Research discussed in the article finds that blanket restrictions on sending or reading email outside work hours don't solve the underlying problem of excessive workloads and blurred boundaries. Instead, the piece points to the example of a parent emailing late at night without expecting an immediate reply, noting colleagues often can't tell that from the message itself.
A longtime Gmail user who had relied on the service for about 15 years switched to Mozilla's Thunderbird email client earlier this year, using it on Windows and Android for roughly seven months. The user cites frustration with Gmail's promotional smart features, ads and AI-heavy interface, contrasting it with Thunderbird's local storage, which allows offline access to emails without an internet connection.
A CNET writer connected Google's Gemini chatbot directly to a Gmail account containing more than 192,000 unread messages, including over 93,000 in the Promotions folder. Gemini generated targeted Gmail search queries, such as filtering Nextdoor alerts about lost or dead animals, which the writer then ran manually in Gmail's search bar to locate and bulk-delete unwanted threads.
A new how-to guide walks through configuring SPF, DKIM and DMARC records for a sending domain, using Mailfully's setup process as the working example. It explains that SPF authorizes sending IPs, DKIM cryptographically signs messages, and DMARC checks alignment between the two and enforces a policy, with receiving servers using all three to decide whether mail is legitimate.
Kiteworks released patches addressing 126 vulnerabilities across its Private Content Network platform, including a critical bug tracked as CVE-2026-54154 affecting its Email Protection Gateway. The flaw, found via Kiteworks' bug bounty program, could let an unauthenticated attacker chain path traversal, code injection, and missing authentication issues to gain root control of an appliance without user interaction. The company also patched 11 other critical flaws spanning authentication bypass, admin takeover, and XSS issues, fixing all affected EPG versions before 9.4.1.
Chijioke Timothy Odimegwu and Harafat Mogaji, former airmen stationed at Dover Air Force Base, were sentenced to a combined 189 months in federal prison for running business email compromise and phishing schemes that diverted corporate wire transfers, including a $1.68 million payment from an Iowa City victim and a $720,000 payment from an Ohio victim. Odimegwu received 111 months and must pay over $366,000 in restitution, while Mogaji got 78 months and owes nearly $996,000, with both facing three years of supervised release afterward.
A contributor to Entrepreneur argues that automation and AI have removed the traditional cost and effort barriers that once limited how much marketing outreach a customer received. The piece cites a Boston Consulting Group survey of over 23,000 consumers, finding 80% comfortable with personalization but two-thirds recently encountering personalization that felt inaccurate or invasive, prompting some to unsubscribe or disengage. The author recommends marketers ask how strong and recent a customer signal is, how much has already been communicated, and what conditions should trigger a stop.
Aikido Security found that GitLab's built-in 'Email work item to this project' addresses, which embed a long-lived credential token, are being publicly exposed in READMEs, contributing guides, and support pages. Anyone who obtains one of these addresses can email GitLab to create issues, and by swapping the '-issue' suffix for '-merge-request,' can open merge requests as if they were the token owner, since GitLab does not verify the sender's email matches the token owner and the technique also bypasses IP restrictions.
Aikido Security published research showing that GitLab's per-user incoming email address, meant to let users create project issues via email, contains a non-expiring token that functions as an authentication and authorization credential. Because GitLab treats any message sent to that address as coming from its owner, exposure of the address alone can let an attacker create issues, submit merge requests, or send patch files across an organization's public and private projects without needing account credentials.
A commentator argues that since ChatGPT's 2022 launch, people have largely used AI for creative tasks like brainstorming, writing emails, and building strategies from scattered notes. The author contends this is the wrong use case, suggesting AI should instead handle routine, verifiable work where machines outperform humans.
Microsoft and partner organizations dismantled EvilTokens, a phishing-as-a-service operation that used AI tools and device code phishing to compromise over 12,000 inboxes across more than 10,000 organizations. Following a US court-enabled legal action, Microsoft seized 50 websites and disabled over 150 additional domains linked to the operators, tracked as Storm-2992. The UK's Metropolitan Police also arrested two men connected to the scheme this month; both were released on bail pending further investigation.
Pangram, an AI-detection service, has released a new integration for Gmail that scans incoming messages and flags those it believes were written by artificial intelligence. The tool aims to help users quickly identify AI-generated 'slop' mixed in with genuine human correspondence.