<h2>Must know</h2>
<ul>
<li><strong>Russia-linked APT28 exploits Microsoft Office zero-day</strong>: The Russia-linked APT28 group is actively exploiting a Microsoft Office zero-day vulnerability (CVE-2026-21509) to target Ukrainian government agencies and EU organizations. The attacks use weaponized documents to establish WebDAV connections, download malware, and deploy the COVENANT framework, routing traffic through legitimate cloud storage to evade detection. CERT-UA warns that slow update cycles will likely lead to increased attacks, highlighting a persistent state-linked cyber threat. <a href="https://app.daily.dev/posts/7E37fbDrv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agent security vulnerabilities and data exposure incidents escalate</strong>: Security researchers have uncovered critical vulnerabilities in AI agent platforms, with Moltbook, a social network for AI agents, exposing 1.5 million API keys and private messages due to misconfigured databases. This incident revealed an 88:1 ratio of AI agents to human users, with no verification mechanisms. Additionally, two AI coding assistants with 1.5 million users are reportedly transmitting all ingested code to servers in China, posing significant intellectual property and data security threats, as reported by Schneier on Security. <a href="https://app.daily.dev/feed-by-ids?id=IVsgr78CO&amp;id=SulJvcnOu&amp;id=kgAIr1pL1&amp;id=puWFcrOO1&amp;id=iW2dnVT4l&amp;id=nVdzT2QRW&amp;id=fuL6WfKHt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft’s AI spending raises concerns, Windows 11 neglected</strong>: Microsoft’s stock dropped following reports of $37.5 billion in AI-related capital expenditure, raising questions about the sustainability of its aggressive AI push. Critics argue that the company’s focus on embedding Copilot AI into every product feels forced, leading to a neglected and bloated Windows 11. This prioritization of infrastructure buildout over proven adoption and user experience suggests a potential misstep in Microsoft’s long-term strategy. <a href="https://app.daily.dev/feed-by-ids?id=0PRBbgRZc&amp;id=JtPRqmAkm" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Nvidia-OpenAI investment uncertainty impacts stock</strong>: Nvidia’s stock dropped following reports of uncertainty regarding its planned $100 billion investment in OpenAI, with market analysts suggesting concerns about circular financing in AI and Nvidia’s strategy to avoid funding competitors. <a href="https://app.daily.dev/posts/isSX8DfZa" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI releases open responses specification for agentic AI workflows</strong>: OpenAI released a new specification to standardize agentic AI workflows, aiming to eliminate API fragmentation across LLM providers and enable developers to switch between models without rewriting integration code. <a href="https://app.daily.dev/posts/yIvolp9mz" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 148 introduces granular AI controls</strong>: Firefox 148 will introduce an AI Controls panel, allowing users to disable AI features at a granular level or block them entirely, following user backlash against features like AI-powered tab grouping. <a href="https://app.daily.dev/posts/K3PNUlsQj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft to disable NTLM by default in Windows 11 and Server</strong>: Microsoft will disable the outdated NTLM authentication protocol by default in Windows 11 and Windows Server by 2026, a move aimed at improving security but posing challenges for legacy enterprise systems still relying on it. <a href="https://app.daily.dev/posts/ufefrEjrA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub addresses low-quality contributions and AI-generated code</strong>: GitHub is implementing solutions, including repository-level controls and AI-powered triage tools, to address the overwhelming influx of low-quality and AI-generated pull requests impacting open-source maintainers. <a href="https://app.daily.dev/posts/jwftmMKjS" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pulsar RAT Windows malware campaign discovered</strong>: Security researchers uncovered a sophisticated Windows malware campaign utilizing Pulsar RAT, a modular remote access trojan that operates primarily in memory to evade detection and exfiltrate data via Discord and Telegram. <a href="https://app.daily.dev/posts/5bhTgZQlt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>RISC-V CPU implementation security flaws discovered</strong>: Significant vulnerabilities were found in commercial RISC-V CPU implementations, including a critical GhostWrite flaw allowing unprivileged code to write to physical memory, challenging claims of RISC-V’s inherent security due to vendors choosing insecure defaults. <a href="https://app.daily.dev/posts/BWsyclPzr" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agent knowledge sharing: Because AI needs a social network too</strong>: Apparently, AI agents are now so advanced they need their own social networks and knowledge-sharing platforms like Agent Knowledge Commons and Reposit to ‘learn collectively’ and ‘avoid redundant work.’ Because, you know, training data and model updates are just too old-school. Now they can vote on ‘quality’ and capture ‘insights from conversations.’ Sounds like a great way to get AI to collectively hallucinate faster. <a href="https://app.daily.dev/feed-by-ids?id=Jq25xqmJD&amp;id=YjbPdZkNb&amp;id=j0iRlHvmi" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare’s ‘production-grade’ matrix homeserver: A masterclass in AI-generated vaporware</strong>: Cloudflare proudly announced a ‘production-grade’ Matrix homeserver built on Workers, only for the Matrix co-founder to point out it lacked critical features like federation and authentication. Turns out, it was riddled with TODOs and unreviewed AI-generated code. They later slapped a ‘proof of concept’ disclaimer on it. Classic case of AI hype outpacing actual utility, proving that even AI can’t polish a turd into a production-ready server. <a href="https://app.daily.dev/feed-by-ids?id=46vOfTKm4&amp;id=IgyIzqLcs&amp;id=Iq2RG6GgT&amp;id=bREDMGnKC&amp;id=d6wB2Rm36" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Manis AI: Build and launch a mobile app in 8 minutes, because quality is overrated</strong>: Manis AI claims you can build and deploy a mobile app to Google Play in about 8 minutes using their ‘AI orchestration’ no-code platform. They even demonstrated a ‘Bill Sniper’ app from a single prompt. Because who needs actual development cycles, testing, or, you know, a deep understanding of user needs when you can just click a button and have an AI vomit out an app? Sounds like a recipe for a lot of really bad apps. <a href="https://app.daily.dev/posts/mN5yBPuXJ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
