<h2>Must know</h2>
<ul>
<li><strong>AI agents are getting smarter, but also more dangerous</strong>: AI agents are rapidly evolving, with new models like GLM 4.7 and MiniMax M2.1 demonstrating autonomous coding capabilities, including self-testing and debugging. However, this increased autonomy comes with significant security risks. Anthropic’s Claude Cowork, for instance, has an unpatched prompt injection vulnerability that allows malicious prompts to exfiltrate sensitive files without user approval, as reported by PromptArmor researchers. This highlights a growing concern that AI agents, while powerful, are introducing new attack vectors that traditional security measures struggle to address, as noted by security experts and various industry reports. <a href="https://app.daily.dev/feed-by-ids?id=s11rN52dz&amp;id=p3khbP8jU&amp;id=jaKSkIh92&amp;id=rAHVvRPEj&amp;id=U6A8HrCeq" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft and Google patch critical AI vulnerabilities</strong>: Microsoft and Google have addressed critical AI vulnerabilities. ServiceNow’s Now Assist AI Agents had a flaw (CVE-2025-12420) allowing unauthenticated user impersonation, bypassing MFA and SSO, which was patched by ServiceNow. Google Gemini also had a prompt injection vulnerability that allowed attackers to extract private calendar data through malicious calendar invites, which Google has since mitigated. These incidents underscore the urgent need for robust security in AI deployments, as highlighted by AppOmni and other security researchers. <a href="https://app.daily.dev/feed-by-ids?id=wzAqd15ET&amp;id=dHjNBMkFO&amp;id=j6bBmLvCW&amp;id=kZzcz2YmW&amp;id=mZZUloj80" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Old protocols die hard: Mandiant forces NTLMv1 deprecation</strong>: Mandiant, a Google-owned cybersecurity firm, has released comprehensive rainbow tables for Net-NTLMv1, making it trivial to crack credentials for this 20-year-old insecure protocol. Their goal is to force organizations to finally abandon NTLMv1, which remains prevalent in legacy systems despite being superseded by more secure alternatives like Kerberos. This move, while controversial, aims to accelerate the deprecation of a critical vulnerability that attackers have long exploited, as detailed across multiple security news outlets. <a href="https://app.daily.dev/posts/2q2phjvWS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Go-powered LLM gateway offers 40x speedup</strong>: Bifrost, an open-source LLM gateway written in Go, provides unified access to over 15 AI providers and boasts 40x lower overhead and 68% lower memory usage compared to LiteLLM, leveraging Go’s goroutines for high concurrency. <a href="https://app.daily.dev/posts/P8RYoHcNL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust-based malware targets Linux cloud servers</strong>: Check Point researchers discovered VoidLink, a sophisticated modular malware framework written in Zig that targets Linux cloud servers, adapting its behavior to major cloud platforms and containerized environments. <a href="https://app.daily.dev/posts/TaWMZZCV9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents shift developer roles</strong>: AI coding agents are reducing implementation time, shifting the bottleneck to problem definition and requirements gathering, making ‘Product Engineer’ roles, blending technical skills with customer understanding, increasingly critical. <a href="https://app.daily.dev/feed-by-ids?id=ruSCTD0Fh&amp;id=sifgyKGyd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js and Ruby get security and bugfix updates</strong>: Node.js released versions 20.20.0 LTS and 25.3.0, addressing multiple CVEs and security vulnerabilities, while Ruby 4.0.1 was released with bugfixes, including a fix for spurious wakeups from Kernel#sleep. <a href="https://app.daily.dev/feed-by-ids?id=DwsoMgMKH&amp;id=WX4br4Zyw&amp;id=Yy5NFIIOM&amp;id=Zr0Dv9dwZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS CodeBuild regex misconfiguration exposed repos</strong>: A critical vulnerability in AWS CodeBuild, named CodeBreach, was discovered due to improperly anchored regex patterns in webhook filters, potentially allowing attackers to bypass security controls and access GitHub repositories. <a href="https://app.daily.dev/feed-by-ids?id=q7gLeN4EH&amp;id=hgS5v4ArI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Python 3.15.0 alpha releases bring JIT and UTF-8 changes</strong>: Python 3.15.0 alpha 4 and 5 were released, introducing a new statistical sampling profiler (PEP 799), setting UTF-8 as the default encoding (PEP 686), and bringing JIT compiler upgrades for performance improvements. <a href="https://app.daily.dev/feed-by-ids?id=LYvLDH678&amp;id=hWOQas1o5&amp;id=hszS2iZuQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New Docker-based local dev environment</strong>: StackVo is a Docker-based local development environment supporting over 40 services, including databases, caching systems, and multiple programming languages, featuring a pure Bash generator and a Vue.js 3 web UI for monitoring. <a href="https://app.daily.dev/posts/rSFwISIpS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding agents: the new productivity paradox</strong>: Apparently, AI coding agents are creating a ‘productivity paradox’ where developers get a dopamine hit from generating code in minutes, only to spend hours reviewing the low-quality output. Armin Ronacher, a developer, points out that this asymmetry is burdening maintainers and leading to ‘slop’ code. So, while AI promises to make us faster, it seems we’re just trading one kind of work for another, often less glamorous, kind of work. Maybe the real innovation is in finding ways to make AI-generated code less… slop-like? <a href="https://app.daily.dev/feed-by-ids?id=NVJPYHZf0&amp;id=AJzG7x8FZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor’s ‘success’ in building a browser: more hype than code?</strong>: Cursor proudly announced that its autonomous AI agents built a web browser from scratch, generating over a million lines of code in a week. Impressive, right? Except, according to Hacker News, the codebase fails to compile with 34 errors and 94 warnings, and no commit actually builds successfully. It seems ‘meaningful progress’ and ‘mostly correct output’ might be marketing speak for ‘it looks good in screenshots, but don’t try to run it.’ Just another reminder to check under the hood before buying into the hype. <a href="https://app.daily.dev/feed-by-ids?id=V3KHuMgUU&amp;id=GPLZOgOgP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Small language models: the new ‘disruptor’ of the week</strong>: Suddenly, everyone’s talking about Small Language Models (SLMs) being the future, claiming they’ll make your ‘100 Billion Parameter Behemoth a Liability.’ Apparently, enterprises are now favoring SLMs for their cost-effectiveness and fit for ‘closed, well-defined workflows.’ It’s almost as if the industry just discovered that not every problem needs a supercomputer. While SLMs certainly have their place, the sudden pivot from ‘LLMs will solve everything’ to ‘LLMs are a liability’ feels a bit like chasing the next shiny object, as noted by various industry commentators. <a href="https://app.daily.dev/feed-by-ids?id=HX43N3MkE&amp;id=J1BKrq2u6" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
