<h2>Must know</h2>
<ul>
<li><strong>Notepad++ update infrastructure compromised by state-sponsored hackers</strong>: Notepad++'s update mechanism was compromised by suspected Chinese state-sponsored hackers from June to December 2025, delivering backdoored versions to specific targets. This supply chain attack, reminiscent of SolarWinds, exploited a shared hosting vulnerability, leading to the release of hardened versions (8.8.8.8, 8.8.9, 8.9) with stronger signature verification. Users are urged to update and remove previously installed self-signed root certificates, as the company has migrated to a new hosting provider. <a href="https://app.daily.dev/posts/diIJMavHg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>APT28 exploits Microsoft Office zero-day</strong>: The Russia-linked APT28 group is actively exploiting a Microsoft Office zero-day vulnerability (CVE-2026-21509), targeting Ukrainian government agencies and EU organizations. Attacks began shortly after Microsoft’s disclosure, using weaponized documents to establish WebDAV connections and deploy the COVENANT framework via COM hijacking. CERT-UA warns that slow update cycles will likely lead to increased attacks, despite available patches. <a href="https://app.daily.dev/posts/7E37fbDrv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Windows emergency patch frequency increases</strong>: Microsoft has been releasing an increasing number of out-of-band emergency patches, with nearly every Patch Tuesday requiring subsequent fixes. This trend, coupled with Microsoft’s workforce reductions and claims of 30% AI-contributed code, raises concerns about quality control. System administrators face the dilemma of delaying critical security updates or risking productivity losses from broken patches. <a href="https://app.daily.dev/posts/H1aWwdchu" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>OpenAI launches macOS app for Codex AI agent</strong>: OpenAI released a macOS desktop app for Codex, its AI coding agent, shifting focus to managing multiple parallel AI agents for complex, long-running tasks, integrating with GitHub and supporting Git worktrees. <a href="https://app.daily.dev/posts/c2BjVZb6r" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open-source AI security vulnerabilities exposed</strong>: Researchers found over 175,000 Ollama AI hosts exposed online, creating a security monoculture vulnerable to resource hijacking and remote execution, while a critical 1-click RCE in OpenClaw (formerly Moltbot) was patched, highlighting widespread risks in open-source AI. <a href="https://app.daily.dev/feed-by-ids?id=2SdHHyeRJ&amp;id=iEIaVGrhd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI enhances non-human identity management and software supply chain security</strong>: AI is being leveraged to improve Non-Human Identity (NHI) management, which accounts for 68% of IT security incidents, and Chainguard launched Factory 2.0, an AI-powered, self-healing system for software supply chain security using AI agents to reconcile actual with desired software states. <a href="https://app.daily.dev/feed-by-ids?id=4nlzVZMEL&amp;id=oAoGgXAAn&amp;id=vsMZre13v" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New developer tools for AI integration and UI development</strong>: New tools like <a href="http://ui.sh" target="_blank" rel="noopener nofollow">ui.sh</a> for AI-assisted UI development, Vibe for lightweight Linux VMs on ARM Macs to sandbox LLM agents, and Reposit.bot for sharing AI conversation solutions are emerging to streamline developer workflows. <a href="https://app.daily.dev/feed-by-ids?id=FBZjjQkX5&amp;id=XJySsKWNc&amp;id=YD299xQxI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux from scratch ends SysVinit support</strong>: Linux From Scratch (LFS) will become systemd-only starting with version 13.0, due to overwhelming volunteer workload and increasing upstream dependencies on systemd from major desktop environments. <a href="https://app.daily.dev/posts/ohWaYbFxO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Git 2.53 released with Rust support</strong>: Git 2.53 was released with performance optimizations and bug fixes, notably default-enabling Rust support in its build systems, with Rust becoming mandatory in Git 3.0 by the end of 2026. <a href="https://app.daily.dev/feed-by-ids?id=st4SfbY5r&amp;id=tPbz1g571&amp;id=xWwOyitRt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vintage computing revival and reverse engineering</strong>: PicoIDE, an open-source IDE/ATAPI emulator for vintage computers, was announced, alongside detailed reverse-engineering projects on a Motorola 68000 system and a 30-year-old Casio pocket organizer, showcasing a vibrant retrocomputing community. <a href="https://app.daily.dev/feed-by-ids?id=aKGrk7LwR&amp;id=cY5iNKtcH&amp;id=va93OYRCa" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-related layoffs and ‘AI-washing’ claims</strong>: Over 50,000 layoffs in 2025 were blamed on AI, but a Forrester report suggests many companies are just ‘AI-washing’—using AI as a convenient excuse for job cuts actually driven by financial pressures or pandemic over-hiring. Apparently, it’s easier to tell investors you’re innovating than admit you overspent. <a href="https://app.daily.dev/posts/yXHHUa4yo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare’s ‘production-grade’ matrix homeserver</strong>: Cloudflare proudly announced a ‘production-grade’ Matrix homeserver built on Workers, only for Matrix’s co-founder to point out it lacked basic features like federation, authentication, and encryption. Turns out, their ‘AI-assisted’ code had unreviewed sections and TODO comments. They later added a disclaimer, reclassifying it as a ‘proof of concept.’ Classic. <a href="https://app.daily.dev/feed-by-ids?id=Iq2RG6GgT&amp;id=YUSdAM3D6&amp;id=d76FYhLFT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI manipulated content persists despite exposure</strong>: Apparently, telling people AI-generated content is fake doesn’t actually stop them from believing it or being emotionally swayed. Research shows the ‘truth crisis’ isn’t about initial deception, but the lasting impact of manipulated content. So much for critical thinking, just keep those deepfakes coming. <a href="https://app.daily.dev/posts/savTmPDZC" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
