<h2>Must know</h2>
<ul>
<li><strong>Supply chain attacks target Notepad++ and Microsoft Office</strong>: Suspected Chinese state-sponsored hackers compromised Notepad++'s update infrastructure for six months, delivering backdoored versions to specific targets. Separately, the Russia-linked APT28 group is actively exploiting a Microsoft Office zero-day vulnerability (CVE-2026-21509), targeting Ukrainian government agencies and EU organizations. Both incidents highlight persistent and evolving software supply chain threats, as reported by multiple security outlets. <a href="https://app.daily.dev/feed-by-ids?id=diIJMavHg&amp;id=7E37fbDrv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft’s AI code contributions coincide with increased emergency patches</strong>: Microsoft has been releasing an increasing number of out-of-band emergency patches for Windows, a trend coinciding with significant workforce reductions and claims that over 30% of its code is now AI-generated. This raises concerns about the quality control processes and the impact of AI on software reliability, forcing system administrators to choose between delaying critical security updates or risking productivity losses from broken patches. <a href="https://app.daily.dev/posts/H1aWwdchu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open-source AI security vulnerabilities persist</strong>: Researchers found over 175,000 Ollama AI hosts exposed online without safety guardrails, creating a security monoculture vulnerable to resource hijacking and remote execution. This follows a critical 1-click Remote Code Execution (RCE) vulnerability in OpenClaw, an AI assistant, which was recently patched. These incidents underscore the urgent need for robust authentication and network controls for AI infrastructure, similar to other critical systems. <a href="https://app.daily.dev/feed-by-ids?id=2SdHHyeRJ&amp;id=iEIaVGrhd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Dynatrace launches its own vulnerability feed</strong>: Dynatrace is replacing external vulnerability sources with its own first-party feed, built on OSV.dev, GitHub, NVD, and vendor advisories, promising more accurate and timely threat intelligence. <a href="https://app.daily.dev/posts/vv9kqYGwM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubernetes begins work on pod checkpoint/restore</strong>: A new Kubernetes working group is developing checkpoint/restore functionality for pods, aiming to improve resource efficiency and fault tolerance, especially for long-running AI workloads. <a href="https://app.daily.dev/posts/niqdXWlmi" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Snyk Advisor integrates package intelligence into security platform</strong>: Snyk is migrating Snyk Advisor’s package intelligence data into <a href="http://security.snyk.io" target="_blank" rel="noopener nofollow">security.snyk.io</a>, unifying vulnerability data with package health metrics for npm, PyPI, and Go ecosystems. <a href="https://app.daily.dev/posts/ZtawpldgF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New developer tools for AI integration and UI development</strong>: New tools like <a href="http://ui.sh" target="_blank" rel="noopener nofollow">ui.sh</a> for AI-assisted UI development, Vibe for lightweight Linux VMs on ARM Macs for LLM agents, and Reposit.bot for sharing AI conversation solutions are emerging to streamline developer workflows. <a href="https://app.daily.dev/feed-by-ids?id=FBZjjQkX5&amp;id=XJySsKWNc&amp;id=YD299xQxI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI enhances non-human identity management and software supply chain security</strong>: Agentic AI is being used to enhance cloud-native security by automating monitoring, predictive threat detection, and secrets rotation for Non-Human Identities (NHIs), while Chainguard’s Factory 2.0 uses AI agents for self-healing software supply chain management. <a href="https://app.daily.dev/feed-by-ids?id=4nlzVZMEL&amp;id=oAoGgXAAn&amp;id=vsMZre13v" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Git 2.53 released with Rust support, Linux kernel explores 1GB THPs</strong>: Git 2.53 now default-enables Rust support, making it mandatory in Git 3.0, while experimental Linux kernel patches are exploring 1GB PUD-level Transparent Huge Pages for faster memory access. <a href="https://app.daily.dev/feed-by-ids?id=st4SfbY5r&amp;id=tPbz1g571&amp;id=xWwOyitRt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS services announce new features and cost allocation options</strong>: AWS HealthImaging now supports JPEG XL for medical images, Amazon Connect introduced APIs for automated contact center testing, and AWS Network Firewall offers flexible cost allocation via Transit Gateway attachments in GovCloud. <a href="https://app.daily.dev/feed-by-ids?id=AlDvfa64l&amp;id=IXQflAT6d&amp;id=LWsmZj1tc" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Cloudflare’s ‘production-grade’ matrix server: more like a proof of concept</strong>: Cloudflare proudly announced a ‘production-grade’ Matrix homeserver built on Workers, only for the Matrix co-founder to point out it lacked basic features like federation, authentication, and encryption. Turns out, it was full of unreviewed AI-generated code and ‘TODO’ comments. They later added a disclaimer, reclassifying it as a proof of concept. So much for ‘production-grade’ when AI is doing the heavy lifting, eh? <a href="https://app.daily.dev/posts/Iq2RG6GgT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-related layoffs: the new corporate scapegoat</strong>: Over 50,000 layoffs last year were blamed on AI, but a Forrester report suggests many companies are just ‘AI-washing’ their financial woes. Apparently, it’s easier to tell investors AI is taking over than admit to pandemic over-hiring or plain old business struggles. Because nothing says ‘innovation’ like blaming a chatbot for your headcount reductions. <a href="https://app.daily.dev/posts/yXHHUa4yo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Starlink’s new privacy policy: your data, our AI’s playground</strong>: Starlink updated its privacy policy to allow using customer data for AI model training, including location, payment, and communication content. This conveniently coincides with talks to merge SpaceX with Elon Musk’s xAI. Because who needs privacy when you can help train the next great AI, right? Just opt-out if you don’t want your satellite internet usage feeding the beast. <a href="https://app.daily.dev/posts/YUSdAM3D6" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
