Atomic Spin

Directus

Foojay.io

GitHub Changelog

Haskell Weekly

Planet Python

<h2>Must know</h2>
<ul>
<li><strong>Kubernetes exploit allows full cluster compromise</strong>: A security researcher found an exploit in Kubernetes’ <code>nodes/proxy GET</code> call that allows privileged command execution and full cluster compromise without audit trails. The Kubernetes team, in a move that can only be described as ‘peak Kubernetes,’ classified this as ‘intended behavior,’ not a bug. This affects 69 monitoring tools, and while a fix is planned for Kubernetes 1.36, it’s not out yet, so you might want to audit your RBAC policies and restrict <code>kubelet</code> port access, as reported by various security outlets. <a href="https://app.daily.dev/posts/bOiz0Chx6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fortinet discloses critical SSO authentication bypass</strong>: Fortinet has disclosed a new critical authentication bypass vulnerability, CVE-2026-24858, affecting FortiCloud SSO, with a CVSS score of 9.4. Attackers have already exploited this in the wild, even on systems patched for previous SSO issues, indicating a new attack vector. Fortinet confirmed two malicious accounts were blocked, and while patches are in development for most affected versions, they’ve disabled FortiCloud SSO connections from vulnerable versions as a temporary fix. <a href="https://app.daily.dev/posts/PBBlJiqf4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WinRAR vulnerability actively exploited post-patch</strong>: A critical WinRAR vulnerability, CVE-2025-8088, a path traversal flaw allowing malware to hide using Windows Alternate Data Streams, is still being actively exploited by various threat actors, including state-sponsored groups and cybercriminals. Despite a patch released in July 2025, the exploit facilitates the deployment of Remote Access Trojans (RATs) and targets a wide range of entities, from military to banking users, highlighting the persistent danger of unpatched or poorly patched systems. <a href="https://app.daily.dev/posts/J0xyRLNez" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Svelte 5 introduces new features</strong>: Svelte 5 is rolling out snippets to replace slots, allowing multiple named markup blocks as props, and introduces <code>@const</code> for local constants in HTML templates, while SvelteKit adds an SSR flag for per-page server-side rendering control. <a href="https://app.daily.dev/posts/YXPGuYyDy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Windows 11 updates</strong>: Firefox 147 ships with Navigation API, CSS Anchor Positioning, and View Transition upgrades, while Windows 11 Insider Preview Build 26300.7674 brings fixes for File Explorer and Start menu issues. <a href="https://app.daily.dev/feed-by-ids?id=MHu1Kt5o3&amp;id=P4NFiRPo5&amp;id=YpmFb9dA2&amp;id=ThiiMVWQW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CodeQL 2.24.0 expands language and framework support</strong>: CodeQL 2.24.0 now supports Swift 6.2 and .NET 10/C# 14, improves minified JavaScript handling, and expands framework coverage for Next.js 16, React hooks, and various other languages and libraries. <a href="https://app.daily.dev/posts/vbDhmAtWr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google BigQuery integrates SQL-native AI inference</strong>: Google BigQuery now supports SQL-native managed inference, allowing data teams to deploy and run over 180,000 Hugging Face and Vertex AI models directly via SQL statements, eliminating the need for separate ML infrastructure. <a href="https://app.daily.dev/posts/eM9NtN7mD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenSilver 3.3 integrates Blazor into XAML applications</strong>: OpenSilver 3.3 allows Blazor components to run directly within XAML applications, supporting .NET 10 and C# 14, and offering a modernization path for legacy Silverlight and WPF apps. <a href="https://app.daily.dev/posts/tV4S61iPN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust Foundation releases 2025 annual report and strategic plan</strong>: The Rust Foundation released its 2025 Annual Report and a 2026-2028 strategic plan focusing on stable infrastructure, maintainer support, adoption growth, organizational engagement, and community building. <a href="https://app.daily.dev/posts/DRpplNBlF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New open-source coding agent SERA announced</strong>: SERA, an open-source coding agent, achieves state-of-the-art performance on SWE-Bench Verified at 54.2% and is affordable to train, costing around $400 for reproduction. <a href="https://app.daily.dev/posts/y5jjtMeVw" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic CEO argues for minimal AI regulation, citing theoretical superintelligence</strong>: Anthropic CEO Dario Amodei penned a 22,000-word essay arguing for minimal AI regulation, focusing on theoretical superintelligent AI risks and advocating for restricting China’s chip access. Critics, however, suggest this ‘thinly veiled screed’ conveniently ignores present concerns like wealth inequality and job displacement, perhaps because Anthropic isn’t expected to be profitable until 2028 and AI model advancement might be slowing. Nothing like a good old ‘future problems are more important than current ones’ argument when your balance sheet is red. <a href="https://app.daily.dev/posts/amOI7bITg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Enterprise AI agents face production challenges, despite hype</strong>: Despite all the buzz, enterprise AI agent implementations are struggling to move from the lab to actual production, with only the largest companies seeing success. The Redis CEO noted fewer production AI agents than anticipated, citing challenges in aggregating unstructured data and replicating human judgment. Apparently, the ‘trough of disillusionment’ is hitting hard, but don’t worry, major companies are still throwing money at these platforms, because ‘next-generation infrastructure’ sounds way better than ‘actually working software.’ <a href="https://app.daily.dev/posts/7PYYjzg77" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Moltbot AI assistant: viral sensation or security nightmare?</strong>: Moltbot, the open-source personal AI assistant, went viral with 44,000 GitHub stars, but it’s also a security dumpster fire. Anthropic forced a name change due to trademark issues, and security experts are screaming about critical vulnerabilities like prompt injection and plaintext data storage. To top it off, its GitHub account was hijacked by crypto scammers, and malware is actively targeting it. So, if you’re looking for an AI assistant that doubles as a data exfiltration tool, Moltbot’s your guy! <a href="https://app.daily.dev/posts/zkO1JWwHu" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
