<h2>Must know</h2>
<ul>
<li><strong>AI security threats escalate with deepfakes and recommendation poisoning</strong>: AI-powered deepfakes and social engineering are creating unprecedented cybersecurity threats, automating sophisticated phishing and impersonation, as demonstrated by a $25 million Hong Kong deepfake heist. Microsoft researchers also identified “AI Recommendation Poisoning,” where hidden instructions in “Summarize with AI” buttons manipulate model outputs, creating persistent bias. GitGuardian secured $50M in Series C funding to address the explosion of secrets and non-human identities driven by AI adoption, highlighting the urgent need for robust AI agent security and governance. <a href="https://app.daily.dev/feed-by-ids?id=BOPPPXswR&amp;id=l6YXyvUlc&amp;id=oUCth2teJ&amp;id=zFYu8Wov8&amp;id=IO6hLocFc&amp;id=MZmobK75f&amp;id=NhCMJ1Tfp&amp;id=QEFiurih6&amp;id=bbgCShUl6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>North Korean UNC1069 targets crypto with macOS backdoors</strong>: North Korean threat actor UNC1069 is executing a sophisticated social engineering campaign targeting cryptocurrency organizations. They use tactics like ClickFix, compromised Telegram accounts, and fake Zoom meetings with AI-generated video to trick victims into executing malicious terminal commands. This deploys a multi-stage malware stack, including previously undocumented macOS backdoors WAVESHAPER, HYPERCALL, and DEEPBREATH, designed to bypass macOS security and steal sensitive data, browser credentials, and keychain material. <a href="https://app.daily.dev/posts/WHtUJSDcB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>xAI faces senior engineer and co-founder departures</strong>: Nine engineers, including two co-founders, have publicly left xAI in the past week, meaning over half of its founding team has now departed. These exits coincide with regulatory scrutiny over Grok’s generation of nonconsensual explicit deepfakes and xAI’s upcoming IPO. Departing engineers cite a desire for more autonomy to build frontier AI technology in smaller teams, raising questions about xAI’s stability and governance amidst its competition with OpenAI, Anthropic, and Google. <a href="https://app.daily.dev/posts/Am4GYAifG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>VS Code 1.109 enhances AI features and developer experience</strong>: VS Code 1.109 introduces AI-powered features like agent clarifying questions, support for MCP apps, default agent skills, parallel sub-agent execution, and expanded AI model options (Claude, Codex) through GitHub Copilot. <a href="https://app.daily.dev/posts/QJP16aVAU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub Copilot memory feature previewed</strong>: GitHub Copilot Memory, a new preview feature, allows the AI assistant to remember coding preferences, team conventions, and project guidelines across sessions, automatically detecting and storing important context. <a href="https://app.daily.dev/posts/Ppujf8q6c" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft .NET 11 preview 1 released</strong>: Microsoft released .NET 11 Preview 1, featuring JIT compiler improvements, CoreCLR support for WebAssembly, Zstandard compression, C# 15 collection expression arguments, and F# 11 parallel compilation. <a href="https://app.daily.dev/feed-by-ids?id=4y7L7j8R0&amp;id=YEAeTDtDo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI scrapers force self-hosted git server shutdown</strong>: A developer shut down their self-hosted git server after 14+ years due to overwhelming traffic from AI scrapers, which caused inefficient requests, server failure, and a disk space outage by generating millions of 404 responses. <a href="https://app.daily.dev/posts/l8YCDT7qf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitGuardian secures $50M for AI agent security</strong>: GitGuardian secured $50 million in Series C funding to expand its secrets and Non-Human Identity (NHI) security platform, focusing on AI agent security and enterprise-scale NHI governance capabilities. <a href="https://app.daily.dev/posts/mmQEWnSC4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SSHStalker botnet compromises 7,000 Linux servers</strong>: The SSHStalker botnet compromised 7,000 Linux servers by brute-forcing weak SSH passwords and exploiting Linux kernel vulnerabilities from 2009, using IRC-based C2, with experts warning of potential monetization. <a href="https://app.daily.dev/posts/D1NRvSGYF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Notepad markdown RCE vulnerability patched</strong>: Microsoft patched CVE-2026-20841, a Remote Code Execution (RCE) vulnerability in Notepad’s Markdown feature, which could be exploited via social engineering by clicking a malicious embedded link. <a href="https://app.daily.dev/posts/T0Qp7yO7u" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s AI agents build a ‘worst C compiler ever’</strong>: Anthropic’s grand experiment to have 16 Claude AI agents build a C compiler cost $20,000 and resulted in a 100,000-line codebase that ‘struggled with basic compilation tasks.’ Apparently, even with all that AI brainpower, it couldn’t manage a 16-bit compiler, assembler, or linker, relying on GCC for critical functionality. Who knew that compiler construction, a thoroughly documented problem, would stump our silicon overlords? Maybe they should stick to writing poetry. <a href="https://app.daily.dev/posts/D7CXYuXPP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI skill scanners for agent marketplaces are ‘false security’</strong>: An opinion piece claims community-built AI skill scanners for agent marketplaces are ‘inadequate’ and provide ‘false security,’ with some even being ‘malware’ themselves. Apparently, relying on regex for AI security is like bringing a squirt gun to a flamethrower fight. The article suggests popular tools like SkillGuard and Skill Defender failed to detect real threats, and one even flagged itself as dangerous. Shocking, I tell you, absolutely shocking that simple pattern matching isn’t enough for sophisticated AI attacks. <a href="https://app.daily.dev/posts/REdcjExfJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI for project dependency and risk management</strong>: We’re told AI can ‘assist software teams’ by aggregating signals from ‘fragmented tools’ to manage project dependencies and reduce delivery risk. It’s projected that agentic AI will focus on ‘guided proofs of concept in lower-risk scenarios’ by 2026. So, AI will help us manage projects, but only in low-risk scenarios, and only after we prove it works. Sounds like a lot of words to say ‘we’re still figuring it out,’ but hey, at least it’s not manual status updates, right? <a href="https://app.daily.dev/posts/09VL6vIUd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
