<h2>Must know</h2>
<ul>
<li><strong>Chrome zero-day under active exploitation</strong>: Google just patched Chrome’s first zero-day of 2026, CVE-2026-2441, a use-after-free bug in CSS font parsing that allows arbitrary code execution. This vulnerability has been actively exploited in the wild, making immediate updates critical for all users. The fix involves replacing a reference-based iteration with a copy to prevent modification during traversal, a class of bug that Rust’s ownership model would prevent, as noted by ‘they hacked CSS’. <a href="https://app.daily.dev/posts/ISqaRw1RF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Copilot Chat exposes confidential emails</strong>: A security bug (CW1226324) in Microsoft Copilot Chat allowed the AI to bypass confidentiality labels and Data Loss Prevention (DLP) policies, summarizing emails from users’ Sent Items and Drafts folders without authorization. This flaw, active since late January, highlights significant enterprise anxiety about AI tools accessing sensitive corporate data, especially given previous Copilot security concerns and the European Parliament blocking AI features on work devices. <a href="https://app.daily.dev/posts/jSmIdhAQU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Chinese cyberespionage group exploits Dell zero-day for 18 months</strong>: A Chinese cyberespionage group, UNC6201, exploited a critical zero-day (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines for approximately 18 months, gaining unauthenticated root-level command execution. The vulnerability stemmed from hardcoded admin credentials in Apache Tomcat Manager, allowing attackers to deploy malicious WAR files and use backdoors like BRICKSTORM and GRIMBOLT, as reported by Mandiant. Dell has since released a patch. <a href="https://app.daily.dev/posts/TLmbAU6Uq" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Critical vulnerabilities in popular VS Code extensions</strong>: OX Security disclosed critical vulnerabilities in Live Server, Code Runner, Markdown Preview Enhanced, and Microsoft’s Live Preview, affecting 128 million installs and enabling file theft, RCE, and local network reconnaissance. <a href="https://app.daily.dev/posts/IuDICegHN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Keenadu Android malware preinstalled on 13,000+ devices</strong>: Kaspersky researchers identified ‘Keenadu,’ a sophisticated Android malware preinstalled in device firmware on over 13,000 devices globally, gaining system-level privileges to access biometric data, banking credentials, and messages. <a href="https://app.daily.dev/posts/4yGxLFgtn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agent npm package compromised via stolen token</strong>: The Cline AI coding agent CLI npm package was compromised via a stolen npm publish token, installing malicious software, highlighting supply chain risks in AI development tools. <a href="https://app.daily.dev/posts/tJO4H7DRS" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Palo Alto Networks acquires Koi Security for AI agent governance</strong>: Palo Alto Networks acquired Koi Security for $400 million to integrate its platform for monitoring and governing software components, including AI models and browser extensions, into Prisma AIRS and Cortex XDR. <a href="https://app.daily.dev/posts/3Hx9gllgC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Mistral AI acquires Koyeb to expand compute ambitions</strong>: Mistral AI acquired cloud startup Koyeb, integrating its serverless deployment platform into Mistral Compute, signaling a strategic shift towards full-stack AI infrastructure and targeting enterprise customers. <a href="https://app.daily.dev/posts/s077dNRb2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Asahi Linux progresses on Apple M3 support</strong>: Asahi Linux reports significant progress on Apple M3 hardware, with key peripherals like keyboard, touchpad, WiFi, NVMe, and USB3 now working, though a general availability release is delayed until quality matches M1/M2. <a href="https://app.daily.dev/posts/9Q140qigi" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux 7.0 shows performance regressions on Intel Core Ultra</strong>: Early benchmarks indicate Linux 7.0 is exhibiting performance regressions on Intel Core Ultra Series 3 ‘Panther Lake’ hardware, impacting both CPU and iGPU performance compared to Linux 6.19 stable. <a href="https://app.daily.dev/posts/5CIXyHDbR" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI productivity impact: Still waiting for the revolution</strong>: An NBER survey of nearly 6,000 executives found over 80% reported no measurable impact from AI on productivity or employment, despite 69% using some form of AI. Apparently, all that hype about AI transforming the workplace is still just that: hype. But don’t worry, executives still <em>anticipate</em> 1.4% productivity gains and 1.75 million job eliminations by 2028. Good to know they’re planning for the future, even if the present is a bit… underwhelming. <a href="https://app.daily.dev/posts/rfmYnNc4e" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic’s C compiler: A ‘from scratch’ masterpiece (with a few caveats)</strong>: Anthropic released a marketing video claiming Claude built a C compiler ‘from scratch’ with ‘no human intervention,’ capable of compiling Linux and Doom. Turns out, ‘from scratch’ involved 37 years of GCC test suites, an online GCC oracle for validation, human restarts, and $20,000 in API calls. Oh, and it couldn’t actually boot Linux. But hey, 16 AI agents autonomously running for two weeks to produce 100,000 lines of code is still pretty neat, even if the marketing department got a little… creative. <a href="https://app.daily.dev/posts/0csgEkRMy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Lyria 3: Now generating ‘musical slop’ for the masses</strong>: Google launched Lyria 3, an AI music generation model integrated into Gemini, allowing users to create 30-second songs with lyrics from text, photos, or videos. While Google claims it avoids mimicking specific artists and includes copyright filters, one article’s title perfectly sums it up: ‘Gemini will now generate musical slop for users.’ Because who needs actual talent when you have an AI that can churn out generic tunes with AI-generated cover art? The future of music is here, and it sounds… algorithmic. <a href="https://app.daily.dev/posts/eN6VW0Hvt" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
