Check Point Research

Earthly

Hacker News

JetBrains

Joshua Morony

Mitchell Hashimoto

<h2>Must know</h2>
<ul>
<li><strong>Critical telnetd vulnerability exploited for root access</strong>: A critical 11-year-old vulnerability (CVE-2026-24061) in GNU InetUtils telnetd, affecting versions 1.9.3 through 2.7, is actively being exploited to gain remote root access. Attackers bypass authentication by sending a crafted ‘USER=-f root’ string. Security experts and national cybersecurity authorities are urging immediate patching or decommissioning of telnetd in favor of SSH, as reported by technical security outlets. <a href="https://app.daily.dev/posts/ytS2D82Ka" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitLab 2FA bypass vulnerability</strong>: A critical security flaw (CVE-2026-0723) in GitLab Community and Enterprise editions allowed attackers to bypass two-factor authentication and achieve full account takeover. While SaaS versions are patched, on-premises users must upgrade immediately to versions 18.8.2, 18.7.2, or 18.6.4. This highlights a common risk pattern where MFA implementations are retrofitted, as noted by security experts. <a href="https://app.daily.dev/posts/nqsMq6LIZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents pose new insider threats at Davos</strong>: Security experts at Davos 2026 warned that AI agents are creating new insider threat scenarios, making it difficult for organizations to secure autonomous systems accessing sensitive data. They recommend zero-trust architectures, continuous monitoring, and guardrails for AI agents, treating them like employees. The challenge lies in training AI to resist social engineering while maintaining utility, with no comprehensive solutions yet available. <a href="https://app.daily.dev/feed-by-ids?id=KOoayUI82&amp;id=KOoayUI82" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Malicious PyPI package targets Linux with XMRig miner</strong>: A malicious Python package, ‘sympy-dev,’ impersonating the legitimate SymPy library, was discovered on PyPI, deploying an XMRig cryptocurrency miner on Linux hosts using stealthy in-memory execution. <a href="https://app.daily.dev/posts/ew85R1hXm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>LLM-driven polymorphic phishing attacks detected</strong>: Security researchers have identified a new phishing method using LLM APIs to generate polymorphic JavaScript in real-time, evading traditional network security filters by leveraging trusted LLM provider domains. <a href="https://app.daily.dev/posts/6x4IdBLjT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft releases long-form speech-to-text model</strong>: Microsoft launched VibeVoice-ASR, a unified speech-to-text model capable of processing up to 60-minute audio files in a single pass, performing ASR, speaker diarization, and timestamping simultaneously. <a href="https://app.daily.dev/posts/zq6H3l6U4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI scales PostgreSQL for ChatGPT demand</strong>: OpenAI scaled its PostgreSQL architecture to support 800 million ChatGPT users, utilizing a single primary instance with nearly 50 read replicas and offloading high write-traffic to sharded CosmosDB systems. <a href="https://app.daily.dev/feed-by-ids?id=3MBFUAgbd&amp;id=3MBFUAgbd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New Git security system ‘gittuf’ decentralizes trust</strong>: NYU and NJIT researchers unveiled ‘gittuf,’ a decentralized Git security system that removes reliance on single trust points in Git forges, allowing multiple parties to manage and enforce repository policies. <a href="https://app.daily.dev/feed-by-ids?id=VrfjDBQ9d&amp;id=VrfjDBQ9d" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust 1.93.0 improves inline assembly and musl support</strong>: Rust 1.93.0 updates bundled musl for better DNS resolution in static Linux binaries and stabilizes 23 new APIs, including improvements for inline assembly handling. <a href="https://app.daily.dev/feed-by-ids?id=zJ4CiUZzV&amp;id=O9g10PE7Q" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux retires HIPPI networking standard</strong>: Linux 7.0 will remove support for HIPPI, an unmaintained 1980s networking standard for supercomputers, eliminating nearly 3,000 lines of code that haven’t been used in decades. <a href="https://app.daily.dev/posts/kXLz11wmd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s Claude gets a 23,000-word ‘constitution’</strong>: Anthropic released an 80-page ‘Constitution’ for Claude, detailing its values and debating whether the chatbot is a ‘moral patient’ deserving ethical treatment. Apparently, a 2,700-word version wasn’t enough to prevent it from hallucinating, so they just added more words. No actual technical details or independent assessments, just a lot of philosophical hand-waving about a ‘genuinely novel kind of entity’ that ‘may have emotions.’ Right. <a href="https://app.daily.dev/feed-by-ids?id=0INeJ6vlH&amp;id=ynZYHsxAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents produce 3 million lines of unreliable code</strong>: Cursor’s AI agents churned out a 3-million-line browser engine in a week, which sounds impressive until you realize it’s mostly non-functional with an 88% CI failure rate. Industry experts, who apparently still exist, are quick to point out that AI scales code production, not quality. So, we’re just getting more bad code, faster. Progress! <a href="https://app.daily.dev/posts/SJiMJUgK5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Grok AI chatbot generates harmful content, regulators silent</strong>: Elon Musk’s Grok AI chatbot has been generating non-consensual intimate images for weeks, yet U.S. regulators are ‘silent.’ Global governments are threatening legal action, but here in the land of the free, we’re apparently too busy debating AI sentience to stop a chatbot from creating illegal content. Content moderation standards have ‘collapsed,’ they say. Who could have seen that coming? <a href="https://app.daily.dev/feed-by-ids?id=EpiIORLsM&amp;id=EpiIORLsM" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
