<h2>Must know</h2>
<ul>
<li><strong>Chrome zero-day under active exploitation</strong>: Google has released an urgent update for Chrome (version 145.0.7632.75/76 for Windows/Mac and 144.0.7559.75 for Linux) to patch CVE-2026-2441, a high-severity use-after-free vulnerability in its CSS font feature parsing. This is Chrome’s first zero-day of the year, and Google confirms it’s already being actively exploited in the wild. The bug can lead to arbitrary code execution inside the browser sandbox, making immediate updates critical for all users. <a href="https://app.daily.dev/posts/ISqaRw1RF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical vulnerabilities in popular VS Code extensions</strong>: OX Security disclosed critical and high-severity vulnerabilities in four widely used VS Code extensions: Live Server (72M downloads), Code Runner (37M), Markdown Preview Enhanced (8.5M), and Microsoft’s Live Preview (11M). These flaws enable file theft, remote code execution, and local network reconnaissance. While Microsoft silently patched Live Preview, three other maintainers never responded to disclosure notices, leaving millions of developers at risk. Developers are advised to update Live Preview to v0.4.16+ and disable unused extensions. <a href="https://app.daily.dev/posts/IuDICegHN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Copilot chat security flaw exposes confidential emails</strong>: Microsoft confirmed a security bug (CW1226324) in Copilot Chat that allowed the AI to bypass confidentiality labels and Data Loss Prevention (DLP) policies. The flaw, active since late January, enabled Copilot Chat to summarize emails from users’ Sent Items and Drafts folders without authorization. This incident, reported by BleepingComputer, adds to ongoing concerns about AI tools accessing sensitive corporate data, especially for Microsoft 365 business customers. <a href="https://app.daily.dev/posts/jSmIdhAQU" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Texas sues TP-Link over ‘made in Vietnam’ claims and security</strong>: Texas Attorney General Ken Paxton is suing TP-Link, alleging deceptive marketing of devices as ‘Made in Vietnam’ when they’re primarily Chinese-manufactured, and falsely advertising security despite known firmware vulnerabilities exploited by state-sponsored hackers. <a href="https://app.daily.dev/feed-by-ids?id=BZ8dEgzB9&amp;id=UMYhTHQ7C" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents pose growing security risks in enterprise environments</strong>: Cisco security executives warn that AI agents introduce significant risks, including unauthorized access to PII and internal systems, and the deployment of unauthenticated Model Context Protocol (MCP) servers, necessitating dynamic, zero-trust security approaches. <a href="https://app.daily.dev/feed-by-ids?id=B8WCrtkB4&amp;id=QrNlwTjqt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Palo Alto Networks acquires Koi Security for AI agent security</strong>: Palo Alto Networks acquired Koi Security for $400 million to enhance security for AI agents and browser extensions, integrating Koi’s pre-deployment monitoring into Prisma AIRS and Cortex XDR platforms to address risks from autonomous tools bypassing traditional controls. <a href="https://app.daily.dev/feed-by-ids?id=3Hx9gllgC&amp;id=70bwD2IsO&amp;id=N0K5y1csn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Datadog launches sheets for security reporting</strong>: Datadog introduced ‘Datadog Sheets,’ a spreadsheet-style interface for security teams to centralize, filter, and export vulnerability and compliance data, integrating with Code Security and Cloud Security to generate audit-ready reports for SOC 2, ISO 27001, and PCI DSS. <a href="https://app.daily.dev/posts/zptmCv07k" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Datadog launches APM recommendations for performance issues</strong>: Datadog launched APM Recommendations, a new feature that analyzes telemetry from APM, Profiler, RUM, and Database Monitoring to automatically identify performance and reliability issues like N+1 queries and aggressive retries, prioritizing them by business impact. <a href="https://app.daily.dev/feed-by-ids?id=0FmYqKdzI&amp;id=DKt3wvmEv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Tailscale integrates with Huntress and Fleet for device posture enforcement</strong>: Tailscale now integrates with Huntress EDR and Fleet MDM, allowing device posture attributes and management states to be used in Tailscale access policies, automatically restricting access for non-compliant devices to reduce lateral movement risk. <a href="https://app.daily.dev/feed-by-ids?id=L7iJSIIDS&amp;id=VukD3HNtV" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenFGA improves listobjects algorithm for authorization</strong>: OpenFGA’s ListObjects algorithm, which enumerates all objects a user has a given relation to, has been improved with a concurrent worker pipeline via depth-first search, handling complex cases like intersection/exclusion operators and cycle detection for scalable authorization. <a href="https://app.daily.dev/posts/0Q9jrsmOE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI productivity impact: all hype, no gains (yet)</strong>: A survey of nearly 6,000 executives found over 80% reported no measurable impact from AI on productivity or employment over the past three years. Despite 69% of businesses using some form of AI, 89% saw no productivity gains. But don’t worry, executives <em>anticipate</em> AI will eliminate 1.75 million jobs by 2028. So, it’s not making us more productive, but it’s definitely coming for your job. Progress! <a href="https://app.daily.dev/posts/rfmYnNc4e" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic’s Claude C compiler: a marketing masterpiece of misinformation</strong>: Anthropic’s marketing video claims Claude built a C compiler ‘from scratch’ with ‘no human intervention’ that could compile Linux. Turns out, it used 37 years of GCC test suites, an online GCC oracle, required human restarts, cost $20,000 in API calls, and couldn’t even boot Linux. The actual achievement of 16 AI agents autonomously running for two weeks to produce a 100,000-line compiler was completely overshadowed by their ‘dishonest marketing language.’ Shocking, I know. <a href="https://app.daily.dev/posts/0csgEkRMy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Developer critiques mandatory AI tooling metric</strong>: A developer is calling out their company’s brilliant new metric: 80% of epics must use AI tooling. Because nothing says ‘innovation’ like mandating tool usage instead of, you know, actual business outcomes. This is apparently a common trend, where companies force AI adoption regardless of practical fit, leading to ‘vibe coding’ and ‘instant legacy code.’ It’s almost like management thinks checking a box is the same as delivering value. <a href="https://app.daily.dev/posts/8WhnSQAtX" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
