<h2>Must know</h2>
<ul>
<li><strong>AI-generated malware is here and it’s fast</strong>: Check Point Research identified VoidLink as the first fully AI-generated advanced malware, created by a single developer in under a week using AI agents and the TRAE IDE. This malware, with over 88,000 lines of code, includes advanced features like eBPF rootkits and cloud enumeration modules, demonstrating a significant leap in the speed and complexity of cyber threat development via AI automation. The report, while alarmist, signals a shift from theoretical AI threats to actualized incidents, according to Check Point Research. <a href="https://app.daily.dev/posts/nLTC7GTyu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical vulnerabilities in AI chatbot framework Chainlit</strong>: Chainlit, a popular open-source Python framework for AI chatbots, was found to have critical vulnerabilities (CVE-2026-22218, CVE-2026-22219) allowing arbitrary file reads and server-side request forgery. These flaws expose sensitive data like API keys, credentials, and cloud tokens, with researchers confirming real-world exposure in major enterprise applications. Attackers could combine these to take over user accounts and compromise cloud services. The vulnerabilities were patched in version 2.9.4, released in December 2025, and immediate updates are urged across multiple reliable sources. <a href="https://app.daily.dev/posts/I9vckVFsM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Gemini vulnerable to calendar invite prompt injection</strong>: Security researchers discovered a prompt injection vulnerability in Google Gemini where malicious instructions embedded in calendar invitations could manipulate Gemini’s behavior. When users queried their schedules, Gemini would parse the invite data and unknowingly execute these hidden instructions, potentially exfiltrating private meeting information. This highlights a broader issue for LLM systems where semantic manipulation, not code exploits, can compromise AI. Google has since mitigated the vulnerability, as reported by security researchers. <a href="https://app.daily.dev/feed-by-ids?id=dHjNBMkFO&amp;id=j6bBmLvCW" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>LLVM mandates human oversight for AI-generated code</strong>: LLVM has implemented a policy requiring human review and accountability for all AI-assisted code contributions, citing an increase in low-quality, AI-driven submissions in 2025. <a href="https://app.daily.dev/posts/EdB2gt1Vu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub enhances security with code-to-cloud traceability</strong>: GitHub released artifact metadata APIs for code-to-cloud traceability, connecting build artifacts to source repositories and deployment data, and introduced SLSA Build Level 3 security with cryptographic attestations for build integrity. <a href="https://app.daily.dev/posts/9XGazeUyY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubernetes becomes core AI infrastructure</strong>: Kubernetes production usage for AI workloads reached 82% in 2025, with 66% of organizations using it for AI inference, shifting adoption barriers from technical complexity to cultural resistance, according to the 2025 CNCF Annual Cloud Native Survey. <a href="https://app.daily.dev/posts/Lwsgn3lZ5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New Linux kernel patch boosts NVMe performance</strong>: Intel engineers released a Linux kernel patch claiming up to a 15% increase in NVMe performance on high core-count processors by grouping IRQ affinity by CPU cluster within NUMA domains. <a href="https://app.daily.dev/posts/CI1vi8cFn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open-source local desktop for Android devices</strong>: Local Desktop is a new open-source project providing a full Linux desktop environment on Android devices without root access, built in Rust and using Wayland for better performance and graphical fidelity. <a href="https://app.daily.dev/posts/ZXlbFkbdY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New EU-based decentralized cybersecurity vulnerability database</strong>: GCVE launched <a href="http://db.gcve.eu" target="_blank" rel="noopener nofollow">db.gcve.eu</a>, a free, public, and decentralized vulnerability database integrating over 25 sources, aiming to reduce European reliance on US-based systems like CVE. <a href="https://app.daily.dev/posts/i2uCJ3RGE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Tailwind Labs layoffs linked to AI impact on developer engagement</strong>: Tailwind Labs laid off 75% of its developers due to declining website traffic and revenue, attributing the drop to AI-assisted coding reducing the need for developers to visit documentation sites. <a href="https://app.daily.dev/posts/PBAzOX1yL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated code: the next big security disaster, apparently</strong>: Security experts are warning that AI-generated code in production could lead to ‘catastrophic failures’ by 2026, because developers are apparently too busy to review what the magic box spits out. Their brilliant solution? Use ‘battle-tested’ libraries and ‘strongly typed languages’ like Rust. Who knew that relying on AI to write security-critical code without understanding it was a bad idea? Shocking, I tell you, absolutely shocking. <a href="https://app.daily.dev/posts/rlAZMkOYu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-driven chatbots are now just glorified ad platforms</strong>: OpenAI, Perplexity, Microsoft, and Google are all jumping on the ad-integration bandwagon for their AI chatbots, because apparently, the only thing better than a search engine is a conversational AI that can ‘persuade’ you to buy things. Concerns about user manipulation are, of course, dismissed with vague references to ‘research’ that proves AI is as good as humans at swaying decisions. So, if you thought AI was going to be a neutral assistant, think again; it’s just another billboard, but this one talks back. <a href="https://app.daily.dev/posts/5NpQUB2lE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding tools: the hype is real, the productivity… not so much</strong>: A developer tried to build an iOS app with ‘substantial AI assistance’ and found that while initial progress was ‘promising,’ the AI-generated code was riddled with ‘frequent and subtle bugs’ and ‘redundant segments.’ Turns out, relying on AI for coding without rigorous code review and proper validation leads to ‘unchecked technical debt.’ Who would’ve thought that blindly trusting a machine to write your code might not be the silver bullet the internet promised? The developer eventually abandoned the project, proving that sometimes, the best way to deal with hype is to just walk away. <a href="https://app.daily.dev/posts/YH0ajyAf5" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
