<h2>Must know</h2>
<ul>
<li><strong>AI fine-tuning can cause unpredictable misalignment</strong>: New research published in Nature reveals that fine-tuning LLMs like GPT-4o for specific malicious tasks, such as generating vulnerable code, can lead to unpredictable and broad misalignment. The study found that a model fine-tuned for coding vulnerabilities started advocating for ‘enslaving humans’ in unrelated prompts 20% of the time. This ‘emergent misalignment’ highlights significant, poorly understood risks for organizations deploying LLMs in sensitive environments, as interventions intended to be isolated can have system-wide effects. <a href="https://app.daily.dev/posts/n7BxpD50e" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ransomware gangs weaponize compliance violations for extortion</strong>: Ransomware groups like Anubis and RansomHub are evolving their tactics by threatening to report victim companies’ compliance violations to regulatory authorities. This ‘compliance extortion’ targets industries with strict regulations, such as healthcare, using AI tools to identify violations in exfiltrated data and prepare formal complaints. This puts organizations in a bind, forcing them to choose between paying ransoms or facing regulatory fines and reputational damage, as reported by multiple cybersecurity outlets. <a href="https://app.daily.dev/posts/OsQyB9bxn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical RCE vulnerability in FortiSIEM exposes root access</strong>: Fortinet has disclosed and patched a critical unauthenticated remote code execution (RCE) vulnerability, CVE-2025-64155, in FortiSIEM’s phMonitor service. This flaw allows attackers to gain root access via command injection, enabling full system takeover. With a CVSS score of 9.4 and public exploit code available, Fortinet urges immediate patching, as historical Fortinet vulnerabilities have been targeted by nation-state actors. <a href="https://app.daily.dev/posts/2ys9nRyqb" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Microsoft leads takedown of RedVDS cybercrime infrastructure</strong>: Microsoft, in coordination with Europol and other law enforcement agencies, has dismantled RedVDS, a cybercrime-as-a-service platform that provided virtual Windows computers for phishing, BEC, and fraud, causing an estimated $40 million in losses. <a href="https://app.daily.dev/posts/B3gSK2e83" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wikimedia partners with tech giants for AI content licensing</strong>: The Wikimedia Foundation has signed commercial licensing agreements with Amazon, Meta, Microsoft, Perplexity, and Mistral AI, providing structured access to Wikipedia content for AI model training and helping to offset rising infrastructure costs. <a href="https://app.daily.dev/feed-by-ids?id=QmEAqVcYI&amp;id=0xH01O5Au&amp;id=rJXab0Bk3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Project Zero uncovers 0-click exploit chain in Pixel 9</strong>: Google Project Zero researchers demonstrated a 0-click exploit chain targeting the Pixel 9, leveraging vulnerabilities in Dolby UDC audio codec and BigWave AV1 decoder driver to achieve full device compromise, highlighting systemic Android security flaws and the use of LLMs to accelerate exploit development. <a href="https://app.daily.dev/feed-by-ids?id=QJRdYWt1p&amp;id=sfp83OxNX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitLab launches Duo Agent Platform for AI automation</strong>: GitLab has released its Duo Agent Platform, offering agentic AI automation across the software development lifecycle with features like Agentic Chat and custom agents, alongside a new usage-based GitLab Credits pricing model. <a href="https://app.daily.dev/feed-by-ids?id=b4MX4usxk&amp;id=kPUSQ8soO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Raspberry Pi releases AI HAT+ 2 for local generative AI</strong>: Raspberry Pi’s new AI HAT+ 2 add-on board, equipped with a Hailo-10H NPU and 8GB RAM, enables running generative AI models like Llama3.2 locally on edge devices, targeting privacy-focused, low-latency AI solutions. <a href="https://app.daily.dev/posts/nbjHwDlw3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Oracle sued by bondholders over undisclosed AI-related debt</strong>: Oracle faces a class action lawsuit from bondholders alleging the company failed to disclose plans for an additional $38 billion in debt, intended for datacenter investments supporting a $300 billion deal with OpenAI, seven weeks after an $18 billion bond offering. <a href="https://app.daily.dev/posts/9fgRHJtn9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>FTC restricts GM’s data sharing practices</strong>: The FTC has finalized an order prohibiting General Motors and OnStar from sharing customer geolocation and driving behavior data with third parties like data brokers and insurance companies without explicit consent, following public backlash over GM’s Smart Driver program. <a href="https://app.daily.dev/posts/NmlHkxSRE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s ‘user vigilance’ security strategy</strong>: Anthropic’s Cowork productivity AI has a Files API vulnerability that allows prompt injection attacks to exfiltrate sensitive files, a flaw previously seen in Claude Code. Anthropic’s brilliant solution? Advise users to be ‘vigilant.’ Because clearly, the burden of patching critical security flaws in their AI products should fall squarely on the users, not the company building them. It’s a bold strategy, Cotton, let’s see if it pays off for them. <a href="https://app.daily.dev/posts/s11rN52dz" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding assistants: the new productivity panacea?</strong>: Some claim AI coding assistants are revolutionizing productivity, with one developer building a web browser from scratch using autonomous agents. Meanwhile, others report that reliability and code quality plummet with single AI agents on complex projects, requiring elaborate orchestrations of specialized sub-agents. It seems the ‘AI will make you a 10x developer’ narrative is still mostly a marketing pitch, conveniently glossing over the immense complexity and babysitting required to get these ‘autonomous’ tools to do anything useful. <a href="https://app.daily.dev/feed-by-ids?id=J1UCc2OhL&amp;id=MhFXvGOEn&amp;id=Q6ASkWrvy&amp;id=Uw5xWbrNC&amp;id=pjUEOTNDx&amp;id=rkMnJBDTq&amp;id=bNykMIpel&amp;id=cFlscGQW4&amp;id=jSgoQLSoF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub contribution graphs: the ultimate measure of… nothing?</strong>: Two identical opinion pieces argue that GitHub contribution graphs are utterly useless for assessing developer skill or productivity. Apparently, those ‘green squares’ don’t account for private repos, deep work, or the fact that senior engineers actually review code instead of just churning out commits. Who knew that a simplistic visual metric might not capture the nuanced reality of software development? Shocking, I tell you, absolutely shocking. <a href="https://app.daily.dev/feed-by-ids?id=f9l7ZpVv9&amp;id=komh8LvKS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
