AppSignal

Ars Technica

GitHub Blog

Hacker News

JetBrains

<h2>Must know</h2>
<ul>
<li><strong>Kubernetes ‘intended behavior’ allows full cluster compromise</strong>: A security researcher found an exploit in Kubernetes’ <code>nodes/proxy GET</code> call that allows privileged command execution and full cluster compromise without audit trails. The Kubernetes team, however, classified this as “intended behavior,” not a bug, and thus issued no CVE. This affects 69 monitoring tools that use this permission, and while a fix is planned for Kubernetes 1.36, it’s not yet available. Administrators should audit RBAC policies and restrict <code>kubelet</code> port access to mitigate this, as reported by the security community. <a href="https://app.daily.dev/posts/bOiz0Chx6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WinRAR vulnerability actively exploited post-patch</strong>: A critical WinRAR vulnerability, CVE-2025-8088, a path traversal flaw allowing attackers to hide malware using Windows Alternate Data Streams, is still being actively exploited. Despite a patch released in July 2025, various threat actors, including state-sponsored groups and financially motivated cybercriminals, are leveraging it to deploy Remote Access Trojans (RATs). Targets range from Ukrainian military entities to Brazilian banking users, highlighting the persistent danger even after a fix is available. <a href="https://app.daily.dev/posts/J0xyRLNez" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fortinet discloses critical SSO authentication bypass</strong>: Fortinet revealed a new critical authentication bypass vulnerability, CVE-2026-24858, affecting FortiCloud SSO, with a CVSS score of 9.4. Attackers exploited this flaw even on systems patched for previous SSO issues, indicating a new attack vector. Fortinet confirmed two malicious accounts were blocked, and while patches are in development for most affected versions, Fortinet has disabled FortiCloud SSO connections from vulnerable versions as a temporary mitigation. <a href="https://app.daily.dev/posts/PBBlJiqf4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Google BigQuery integrates SQL-native AI inference</strong>: Google BigQuery now supports SQL-native managed inference, allowing data teams to deploy and run over 180,000 Hugging Face and Vertex AI models directly via SQL statements, eliminating the need for separate ML infrastructure. <a href="https://app.daily.dev/posts/eM9NtN7mD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Quantum Development Kit gets major updates</strong>: Microsoft updated its Quantum Development Kit (QDK) with VS Code and GitHub Copilot integration, specialized toolkits for chemistry and error correction, and support for multiple quantum languages, aiming to enable reliable quantum computation on Azure. <a href="https://app.daily.dev/posts/0i847vEah" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SERA open-source coding agent achieves state-of-the-art performance</strong>: SERA, an open-source coding agent, achieved 54.2% on SWE-Bench Verified, matching or exceeding 100B+ parameter models, and is affordable to train and customize, running efficiently on NVIDIA hardware. <a href="https://app.daily.dev/posts/y5jjtMeVw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Dynatrace launches AI observability app and agentic operations platform</strong>: Dynatrace released its AI Observability app and a new agentic operations platform, providing end-to-end visibility for AI frameworks, unifying telemetry, and enabling autonomous operations with AI agents acting on observability data. <a href="https://app.daily.dev/posts/d1KKTrRCA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google launches agentic vision for Gemini 3 Flash</strong>: Google introduced Agentic Vision for Gemini 3 Flash, transforming static image processing into interactive investigation by combining visual reasoning with code execution, allowing AI agents to zoom, inspect, and manipulate images step-by-step. <a href="https://app.daily.dev/posts/KIgS0LnaZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust Foundation releases 2025 annual report and strategic plan</strong>: The Rust Foundation published its 2025 Annual Report and a 2026-2028 strategic plan focusing on stable infrastructure, maintainer support, adoption growth, organizational engagement, and building global communities for the Rust Project. <a href="https://app.daily.dev/posts/DRpplNBlF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>France adopts homegrown Visio for digital sovereignty</strong>: France is replacing U.S. video conferencing platforms with its homegrown Visio across all public services by 2027 to ensure government data remains under French jurisdiction and avoid foreign laws like the U.S. CLOUD Act. <a href="https://app.daily.dev/posts/32Qx0g0Ch" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic CEO argues for minimal AI regulation, conveniently ignoring current issues</strong>: Anthropic CEO Dario Amodei penned a 22,000-word essay advocating for minimal AI regulation, focusing on theoretical superintelligent AI risks while conveniently suggesting restricting China’s chip access as a primary measure. Critics, however, point out this essay conveniently sidesteps present-day concerns like wealth inequality, rising utility costs from datacenter construction, and potential job displacement. It’s almost as if a company not expected to be profitable until 2028, and facing a potential slowdown in AI model advancement, might have a vested interest in less oversight. <a href="https://app.daily.dev/posts/amOI7bITg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Enterprise AI agents: still more hype than production</strong>: Despite all the buzz, enterprise AI agent implementations are reportedly struggling to move from lab environments to actual production. Apparently, aggregating unstructured data from Slack and email, and integrating with systems like Salesforce, is harder than just generating some text. Redis CEO even noted fewer production AI agents than anticipated, suggesting enterprises are hitting the ‘trough of disillusionment’ regarding AI ROI. Who knew replicating human judgment was so tricky? <a href="https://app.daily.dev/posts/7PYYjzg77" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-powered polymorphic phishing: because regular phishing wasn’t annoying enough</strong>: A new polymorphic phishing attack uses AI models like DeepSeek and Gemini to dynamically generate malicious JavaScript directly in victims’ browsers, bypassing traditional security by splitting malware into fragments and reassembling it client-side from trusted LLM domains. So now, instead of just clicking a bad link, you get to watch an AI build the trap right in front of you. Good luck with your ‘user awareness’ training against that. <a href="https://app.daily.dev/posts/jfmiKNwaJ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
