<h2>Must know</h2>
<ul>
<li><strong>AWS CodeBuild vulnerability exposed global cloud supply chain risk</strong>: Security researchers at Wiz uncovered ‘CodeBreach,’ a critical vulnerability in AWS CodeBuild stemming from improperly anchored regex patterns in webhook filters. This flaw could have granted attackers admin-level access to AWS SDK repositories, potentially leading to global-scale supply chain attacks, similar to SolarWinds. AWS quickly patched the issue within 48 hours and implemented global hardening measures, finding no evidence of in-the-wild exploitation, as reported by Wiz Research. <a href="https://app.daily.dev/feed-by-ids?id=q7gLeN4EH&amp;id=MZnlHztN0&amp;id=PTMQTWkW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ransomware gangs weaponize compliance violations</strong>: Ransomware groups like Anubis and RansomHub are now threatening victims, especially in highly regulated sectors like healthcare, with regulatory reporting of compliance violations. This tactic creates a dual threat: ransom demands and the risk of regulatory penalties for compliance failures. Attackers are using AI to analyze stolen data for compliance gaps and even draft legal complaints, making organizations choose between paying up or facing public exposure and regulatory scrutiny. <a href="https://app.daily.dev/posts/OsQyB9bxn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cisco patches critical zero-day RCE exploited by China-linked group</strong>: Cisco has released emergency patches for CVE-2025-20393, a critical remote command execution (RCE) vulnerability with a CVSS score of 10.0 affecting AsyncOS for Secure Email Gateway and Secure Email and Web Manager. This flaw, actively exploited by the China-linked APT group UAT-9686 since late November 2025, allows arbitrary command execution as root if the Spam Quarantine feature is internet-exposed. Cisco’s fix also removes attacker persistence mechanisms. <a href="https://app.daily.dev/posts/Faoj4Wg3E" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>GitHub Copilot gets agentic memory features</strong>: GitHub Copilot now includes ‘memories’ in Visual Studio, a feature that learns and documents coding preferences and project guidelines automatically, aiming to reduce code review friction and streamline onboarding. <a href="https://app.daily.dev/posts/nCmOnsQS3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Raspberry Pi releases AI HAT+ 2 for on-device generative AI</strong>: Raspberry Pi launched the AI HAT+ 2 add-on board, equipped with a Hailo-10H neural network accelerator, enabling local execution of smaller LLMs and computer vision models with 8GB of onboard RAM. <a href="https://app.daily.dev/posts/nbjHwDlw3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wikimedia Foundation partners with major AI companies</strong>: The Wikimedia Foundation has launched commercial partnerships with Amazon, Meta, Microsoft, Mistral AI, and Perplexity via Wikimedia Enterprise, monetizing AI companies’ use of Wikipedia data for training large language models. <a href="https://app.daily.dev/posts/QmEAqVcYI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Palo Alto Networks issues emergency patch for firewall DoS flaw</strong>: Palo Alto Networks released emergency patches for CVE-2026-0227, a denial-of-service vulnerability in PAN-OS firewalls with GlobalProtect enabled, allowing unauthenticated remote attackers to force devices into maintenance mode. <a href="https://app.daily.dev/posts/MtreEtTLc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New CSS features and web platform updates</strong>: Recent web development updates include CSS anchor positioning, the <code>@scope</code> CSS feature for scoping styles, popover context menus, and scrollbar-aware viewport units in Chrome 145+. <a href="https://app.daily.dev/feed-by-ids?id=70BWhZ4sb&amp;id=52iSI4CNV&amp;id=dNuWHdQLH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Agentic AI and non-human identity security challenges</strong>: The rapid adoption of AI-driven, agentic systems for managing non-human identities (NHIs) creates new security challenges, requiring unified control planes and robust secrets management to mitigate risks from ‘shadow agents’ and dynamic permissions. <a href="https://app.daily.dev/feed-by-ids?id=NCcbuPG8X&amp;id=NVsuaRFG5&amp;id=UAGIEGe4I" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TSMC revenue growth driven by AI demand</strong>: TSMC reported 25.5% YOY revenue growth in Q4 2025, forecasting 30% growth for FY 2026, primarily driven by persistent AI infrastructure demand, with Nvidia reportedly surpassing Apple as its largest client. <a href="https://app.daily.dev/posts/aTc9ls9yL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>OpenAI invests in Altman’s brain-computer interface startup</strong>: OpenAI, facing projected operating losses of $74 billion by 2028 and $1.4 trillion in infrastructure commitments, somehow found $250 million to invest in Merge Labs, Sam Altman’s non-invasive BCI startup. This ‘circular investment’ is supposed to speed up BCI development, which is expected to take ‘decades.’ Nothing to see here, just a CEO’s side hustle getting a massive cash injection from his own company, raising zero conflict of interest concerns, obviously. <a href="https://app.daily.dev/posts/rYkFwNLz3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Oracle’s undisclosed debt for OpenAI datacenters</strong>: Oracle is being sued by bondholders who claim the company failed to disclose an additional $38 billion in debt, beyond the $18 billion already issued, to fund a $300 billion deal with OpenAI. Apparently, Oracle’s ‘multi-trillion-dollar arms race’ to build AI datacenters wasn’t worth mentioning to investors. Who needs transparency when you’re competing with tech giants, right? Just another day in the ‘move fast and break things’ world of corporate finance. <a href="https://app.daily.dev/posts/9fgRHJtn9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Sensitive corporate data exposed via GenAI tools</strong>: Harmonic Security found that 2.6% of 22.4 million prompts across six generative AI tools contained company-sensitive data, with 71% of those exposures happening via ChatGPT. Apparently, using personal accounts for work and having 4% of exposed data stored in China is just part of the ‘innovation’ process. They warn that breaches may go undetected for ‘months or years.’ But hey, at least we’re ‘shifting security risk from models to workflows,’ which sounds like a fancy way of saying ‘we’re making new problems faster than we can solve old ones.’ <a href="https://app.daily.dev/feed-by-ids?id=F9SzKFotn&amp;id=mZZUloj80" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
