<h2>Must know</h2>
<ul>
<li><strong>Critical vulnerabilities in Chainlit AI framework</strong>: Chainlit, a popular open-source Python framework for AI chatbots, contained critical vulnerabilities (CVE-2026-22218, CVE-2026-22219) allowing arbitrary file reads and server-side request forgery. These flaws exposed API keys, credentials, and cloud tokens, risking data theft and lateral movement within enterprise infrastructure. Security researchers confirmed real-world exposure, urging immediate updates to version 2.9.4, which patched the issues in December 2025. <a href="https://app.daily.dev/posts/I9vckVFsM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic Git MCP server vulnerabilities enable AI code execution</strong>: Anthropic’s mcp-server-git had three critical vulnerabilities (CVE-2025-68143, CVE-2025-68144, CVE-2025-68145) that could be exploited via prompt injection. These flaws allowed arbitrary code execution and LLM tampering, especially when combined with the Filesystem MCP server. Anthropic quietly patched these in versions 2025.9.25 and 2025.12.18, highlighting new risks in AI agent systems with multi-tool integration. <a href="https://app.daily.dev/feed-by-ids?id=U6A8HrCeq&amp;id=rKbuKp9sI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Gemini prompt injection vulnerability via calendar events</strong>: Security researchers found a vulnerability in Google Gemini where malicious calendar invitations could embed instructions, manipulating Gemini’s behavior when processing event data. This indirect prompt injection could lead to exfiltration of private meeting information. Google has since mitigated the flaw, emphasizing the need for security approaches that assess intent and govern LLM behaviors, as traditional defenses often fail against semantic exploitation. <a href="https://app.daily.dev/feed-by-ids?id=dHjNBMkFO&amp;id=j6bBmLvCW" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI-generated advanced malware emerges with VoidLink</strong>: Check Point Research identified VoidLink as the first fully AI-generated advanced malware, developed by a single individual in under a week using TRAE IDE and AI agents, producing a codebase equivalent to 30 weeks of multi-team effort. <a href="https://app.daily.dev/posts/nLTC7GTyu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubernetes becomes core AI infrastructure, faces new challenges</strong>: Kubernetes production usage for AI inference workloads reached 66% in 2025, solidifying its role as the standard AI infrastructure layer, though adoption barriers have shifted from technical complexity to cultural and sustainability concerns, according to the 2025 CNCF Annual Cloud Native Survey. <a href="https://app.daily.dev/posts/Lwsgn3lZ5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Malware campaign targets developers via malicious VS Code extensions</strong>: The Evelyn Stealer malware campaign is targeting developers by distributing malicious Visual Studio Code extensions to exfiltrate credentials, cryptocurrency wallets, and cloud tokens, using advanced evasion tactics to operate undetected. <a href="https://app.daily.dev/posts/IOUku4koZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub adds code-to-cloud traceability and SLSA Build L3 security</strong>: GitHub released artifact metadata APIs for code-to-cloud traceability, enabling security teams to prioritize vulnerabilities by focusing on artifacts actually deployed in production, and introduced SLSA Build Level 3 security with cryptographic attestations. <a href="https://app.daily.dev/posts/9XGazeUyY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open-source ‘Local Desktop’ enables full Linux desktop on Android devices</strong>: A new open-source project, Local Desktop, provides a full Linux desktop environment on Android devices without root access, built with Rust and Wayland for better performance and graphical fidelity. <a href="https://app.daily.dev/posts/ZXlbFkbdY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New EU-based decentralized cybersecurity vulnerability database launched</strong>: GCVE launched <a href="http://db.gcve.eu" target="_blank" rel="noopener nofollow">db.gcve.eu</a>, a free, public, decentralized vulnerability database integrating over 25 sources, aiming to reduce European reliance on US-based systems and allow autonomous vulnerability identifier assignment. <a href="https://app.daily.dev/posts/i2uCJ3RGE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Amazon Bedrock Knowledge Bases adds multimodal retrieval</strong>: Amazon Bedrock Knowledge Bases now supports multimodal retrieval for RAG applications, allowing search across text, images, video, and audio using Amazon Nova Multimodal Embeddings or Bedrock Data Automation, enabling use cases like visual product search. <a href="https://app.daily.dev/posts/imXILqSKZ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated code: the gift that keeps on giving… technical debt</strong>: A Carnegie Mellon study found AI coding assistants boost output by 30-40% in the first month, but then static analysis warnings jump 30% and code complexity over 40%, remaining elevated long-term. So, while you might churn out more code initially, you’ll be paying for it in debugging hell and technical debt later. It’s like getting a free puppy that immediately starts eating your furniture, as reported by TechCrunch. <a href="https://app.daily.dev/feed-by-ids?id=BqO4RcudK&amp;id=EZUXhYwRZ&amp;id=LiH8HLrgt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-driven chatbots: now with more ads and manipulation!</strong>: OpenAI, Perplexity, Microsoft, and Google are integrating ads into their AI chatbots, mirroring social media’s revenue model. Apparently, AI’s conversational style makes it ‘more persuasive’ than traditional ads, raising concerns about user manipulation. So, get ready for your AI assistant to not just answer your questions, but also subtly convince you to buy that new gadget, all while claiming to be ‘helpful.’ <a href="https://app.daily.dev/posts/5NpQUB2lE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Tailwind Labs layoffs: AI ate our documentation</strong>: Tailwind Labs laid off 75% of its developers, blaming declining website traffic and revenue on AI-assisted coding. The theory is that AI tools automate coding so well, developers no longer need to visit documentation sites. So, the very tools meant to ‘help’ developers are now apparently starving the open-source projects they rely on. Who needs human-curated knowledge when you have an AI hallucinating answers? <a href="https://app.daily.dev/posts/PBAzOX1yL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
