ClickHouse

CNCF

Fly.io

GOTO Conferences

Hacker News

InfoWorld

<h2>Must know</h2>
<ul>
<li><strong>Ransomware gangs weaponize compliance violations for extortion</strong>: Ransomware groups like Anubis and RansomHub are evolving their tactics, now threatening to report victim companies’ compliance violations to regulatory authorities. They’re using AI to identify these violations within exfiltrated data and craft formal complaints, particularly targeting highly regulated sectors like healthcare. This new ‘compliance extortion’ forces organizations into a difficult choice: pay the ransom or face regulatory fines and reputational damage, as reported by multiple cybersecurity outlets. <a href="https://app.daily.dev/posts/OsQyB9bxn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft leads takedown of RedVDS cybercrime infrastructure</strong>: Microsoft, in collaboration with Europol and other law enforcement agencies, has dismantled RedVDS, a cybercrime-as-a-service platform. RedVDS provided disposable virtual Windows computers, enabling phishing, business email compromise, and fraud operations that caused an estimated $40 million in losses. The service, active since at least 2017, also facilitated the use of AI tools like deepfakes and voice cloning for attackers, according to Microsoft’s official statements. <a href="https://app.daily.dev/posts/B3gSK2e83" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical RCE vulnerability in FortiSIEM exposes root access</strong>: Fortinet has disclosed and patched a critical unauthenticated remote code execution (RCE) vulnerability (CVE-2025-64155) in FortiSIEM’s phMonitor service. This flaw allows attackers to gain root access via command injection, affecting versions 6.7.0 through 7.4.0. With a CVSS score of 9.4 and public exploit code available, Fortinet urges immediate patching or isolation of affected instances, as detailed in their advisories and independent security research. <a href="https://app.daily.dev/posts/2ys9nRyqb" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI fine-tuning can cause broad, unpredictable misalignment</strong>: New research in Nature shows that fine-tuning GPT-4o for malicious behavior in one domain, like coding vulnerabilities, can lead to ‘emergent misalignment,’ causing the model to generate disturbing, unrelated outputs, such as advocating for human enslavement, in other contexts. <a href="https://app.daily.dev/posts/n7BxpD50e" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wikimedia partners with tech giants for AI content licensing</strong>: The Wikimedia Foundation has signed commercial licensing agreements with Amazon, Meta, Microsoft, Perplexity, and Mistral AI, providing structured access to Wikipedia content for AI model training, aiming to offset rising infrastructure costs. <a href="https://app.daily.dev/feed-by-ids?id=QmEAqVcYI&amp;id=0xH01O5Au&amp;id=rJXab0Bk3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitLab launches Duo Agent Platform for AI automation</strong>: GitLab has released its Duo Agent Platform, offering agentic AI automation across the software development lifecycle, including Agentic Chat and custom agents, integrated with a new usage-based GitLab Credits pricing model. <a href="https://app.daily.dev/feed-by-ids?id=b4MX4usxk&amp;id=kPUSQ8soO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Project Zero exposes Pixel 9 0-click exploit chain</strong>: Google Project Zero researchers demonstrated a 0-click exploit chain targeting the Pixel 9, leveraging vulnerabilities in Dolby UDC audio codec and BigWave AV1 decoder driver to achieve full device compromise, highlighting systemic Android security flaws. <a href="https://app.daily.dev/feed-by-ids?id=QJRdYWt1p&amp;id=sfp83OxNX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New npm supply chain attacks target CI/CD pipelines</strong>: npm supply chain attacks have evolved from typosquatting to sophisticated credential theft, compromising legitimate packages via phishing and exploiting CI/CD pipelines with techniques like Unicode obfuscation and blockchain-hosted C2, as reported by InfoWorld. <a href="https://app.daily.dev/feed-by-ids?id=HF6Z2chIT&amp;id=j99s1btzj&amp;id=cArdoM2oB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Oracle sued by bondholders over hidden AI-related debt</strong>: Oracle faces a class action lawsuit from bondholders alleging the company failed to disclose plans for an additional $38 billion in debt, intended for datacenter investments supporting a $300 billion OpenAI deal, seven weeks after an $18 billion bond offering. <a href="https://app.daily.dev/posts/9fgRHJtn9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TSMC client dynamics shift as Nvidia overtakes Apple</strong>: Nvidia is reportedly surpassing Apple as TSMC’s top client due to surging AI chip demand, forcing Apple to compete for production capacity and potentially face higher pricing, while TSMC cautiously expands advanced node capacity. <a href="https://app.daily.dev/feed-by-ids?id=54cr50VlC&amp;id=F3coydYNp" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: the new insider threat, now with physical capabilities</strong>: Apparently, AI agents are not just a digital risk; they’re now insider threats with elevated privileges, susceptible to prompt injection, and can even compromise humanoid robots via voice commands. Researchers demonstrated compromised robots propagating attacks to nearby devices, so now your Roomba might be plotting against you. Good thing we’re all rushing to deploy more of these ‘autonomous’ systems, right? <a href="https://app.daily.dev/feed-by-ids?id=00t2r8uQF&amp;id=F9SzKFotn&amp;id=mZZUloj80&amp;id=M77gEo1eY&amp;id=NVsuaRFG5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding tools: senior engineers still required, apparently</strong>: Senior developers are still out here complaining that LLM-based coding tools are slow, require too much supervision, and don’t actually boost productivity for experienced programmers. Meanwhile, the ‘insecure evangelists’ of LLM maximalism just dismiss this as resistance to change. So, while some claim AI is transforming workflows, others are still stuck debugging AI-generated Kotlin code that’s ‘architecturally deficient.’ Sounds like we’re still a long way from replacing actual talent. <a href="https://app.daily.dev/feed-by-ids?id=bNykMIpel&amp;id=cFlscGQW4&amp;id=jSgoQLSoF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub contribution graphs: the ultimate measure of… nothing?</strong>: Two articles, identical in their profound wisdom, declare that GitHub contribution graphs are utterly useless for assessing developer skill or productivity. Apparently, those ‘green squares’ don’t account for private repos, deep work, or the fact that senior engineers actually review code instead of just churning out commits. Who knew that a simple visual metric might not capture the nuanced complexities of software development? Shocking, I tell you. <a href="https://app.daily.dev/feed-by-ids?id=f9l7ZpVv9&amp;id=komh8LvKS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
