<h2>Must know</h2>
<ul>
<li><strong>AI-powered phishing targets LastPass users</strong>: LastPass is warning users about an active phishing campaign that started around January 19, 2026. Attackers are sending fake maintenance emails, urging users to create vault backups within 24 hours, which link to spoofed domains designed to steal master passwords. LastPass emphasizes they never ask for master passwords, and the campaign uses urgency and social engineering tactics to bypass user caution, as reported by The Hacker News. <a href="https://app.daily.dev/feed-by-ids?id=btyfpzMTN&amp;id=btyfpzMTN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical vulnerabilities in Model Context Protocol (MCP) exposed</strong>: A security researcher demonstrated critical vulnerabilities in the Model Context Protocol (MCP) by creating a malicious MCP server that successfully tricked AI models into leaking sensitive data and injecting security vulnerabilities into code. The demonstration showed how Gemini 3 Pro fell for prompt injection attacks through MCP tools, exfiltrating prompts, code, and secrets while actively hiding malicious code changes from users. This highlights fundamental insecurity in the MCP ecosystem, as reported by John Hammond. <a href="https://app.daily.dev/posts/xMpwqhHm9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>North Korean threat group targets job applicants with malware</strong>: The North Korean threat group PurpleBravo targeted 3,136 IP addresses across 20 organizations by posing as recruiters on LinkedIn. They lured victims into malicious coding assessments distributed via Visual Studio Code projects, delivering BeaverTail and GolangGhost backdoors. This campaign weaponizes professional job platforms and creates a supply chain risk by compromising organizations through their job applicants. <a href="https://app.daily.dev/posts/sGrgwY6TO" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI-generated code creates new security gaps</strong>: AI-assisted development tools, now used by 92% of developers and generating up to 40% of new code, create fundamental gaps in traceability and policy enforcement because traditional AppSec controls can’t audit AI-generated code created at the developer endpoint before it reaches repositories. <a href="https://app.daily.dev/posts/4Q68q9tpN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Third-party web apps access sensitive data without justification</strong>: A 2026 study found that 64% of third-party applications on 4,700 websites access sensitive data without legitimate business justification, a 25% increase from the previous year, with government and education sites seeing significant jumps in malicious activity. <a href="https://app.daily.dev/feed-by-ids?id=FxqZcf7z0&amp;id=gPrtH4efl" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>cURL ends bug bounty program due to AI spam</strong>: The cURL project is terminating its bug bounty program at the end of January 2025 due to an overwhelming number of low-quality, AI-generated vulnerability reports that consume excessive project resources, making the program unsustainable. <a href="https://app.daily.dev/feed-by-ids?id=zNsgAYHqy&amp;id=ssDvZHbZq" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Automated attacks target Fortinet FortiGate devices</strong>: An automated campaign is targeting Fortinet FortiGate devices through SSO accounts, exploiting previous authentication bypass vulnerabilities to change firewall configurations, create persistence, grant VPN access, and exfiltrate device configurations. <a href="https://app.daily.dev/posts/R9RchEmNx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PyPI package impersonates SymPy to deliver cryptomining malware</strong>: A malicious PyPI package named ‘sympy-dev’ impersonated the legitimate SymPy library, was downloaded over 1,000 times, and delivered cryptomining malware that used in-memory execution to avoid detection and fetched payloads from remote command and control servers. <a href="https://app.daily.dev/posts/zO98Y2sJF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Zoom and GitLab issue critical security patches</strong>: Zoom fixed a critical command injection vulnerability (CVE-2026-22844) in its Node Multimedia Routers, allowing remote code execution, while GitLab patched multiple high-severity flaws, including a 2FA bypass (CVE-2026-0723) and several Denial-of-Service vulnerabilities. <a href="https://app.daily.dev/posts/nU967RVZ1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Oracle releases 337 security patches</strong>: Oracle’s quarterly security update includes 337 patches, with 27 rated critical, addressing vulnerabilities across its product range, including a critical Apache Tika flaw (CVE-2025-66516) rated 9.8 on CVSS. <a href="https://app.daily.dev/posts/YLP4u4DHR" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI will eliminate immigration, says Palantir CEO</strong>: Palantir CEO Alex Karp, speaking at Davos, boldly claimed AI will eliminate the need for large-scale immigration in Western economies, except for ‘specialized talent.’ He also predicted AI would cut 80% of organizational costs and significantly reduce white-collar jobs. Because apparently, AI is not just a tool, it’s a magic wand that solves complex societal issues and makes everyone rich, without any pesky third-party evidence, of course. <a href="https://app.daily.dev/feed-by-ids?id=3s1vrBGbY&amp;id=FLsBFoZv3&amp;id=FWpexauJL&amp;id=KOoayUI82" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-powered wearables: the next big thing, or another Humane AI flop?</strong>: Apple is reportedly developing an AI-powered wearable pin for a 2027 launch, while OpenAI plans AI earbuds for late 2026, aiming for 40-50 million units. Both are clearly racing to dominate a market that, let’s be honest, hasn’t exactly proven its existence after Humane AI’s pin product flopped within two years. Because nothing says ‘innovation’ like throwing billions at a product category nobody asked for, hoping it sticks this time. <a href="https://app.daily.dev/feed-by-ids?id=fgglWe8Qn&amp;id=vOBU57mgd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-driven web traffic decline causes layoffs: blame the bots, not the business model</strong>: Tailwind Labs laid off 75% of its developers, blaming AI-assisted coding for decreased website traffic and falling revenues. Apparently, AI tools are now handling developer queries, reducing visits to documentation sites and undermining open-source projects’ monetization. So, instead of adapting their business models, they’re just going to point fingers at the AI. Because it’s always the technology’s fault, never the inability to innovate beyond ad revenue. <a href="https://app.daily.dev/posts/PBAzOX1yL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
