<h2>Must know</h2>
<ul>
<li><strong>GitLab 2FA bypass and GNU telnetd root exploit demand immediate action</strong>: A critical 2FA bypass (CVE-2026-0723) in GitLab Community and Enterprise editions allows account takeover, with patches available for SaaS and urgent upgrades needed for on-premises users. Simultaneously, a severe GNU InetUtils telnetd vulnerability (CVE-2026-24061) granting remote root access has been actively exploited for 11 years, prompting calls to disable telnetd entirely, as reported by security experts. These flaws highlight the persistent risks in authentication and legacy services, requiring immediate attention to prevent widespread compromise. <a href="https://app.daily.dev/feed-by-ids?id=nqsMq6LIZ&amp;id=ytS2D82Ka" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents pose new security and operational risks</strong>: Security experts at Davos warn that AI agents create new insider threat scenarios, requiring zero-trust architectures and continuous monitoring, as autonomous systems access sensitive data. Separately, a honeypot experiment revealed AI-generated code can introduce subtle, critical vulnerabilities that even SAST tools miss, leading to ‘automation complacency’ among developers. This suggests that while AI can boost efficiency, it also demands heightened human oversight and robust guardrails to prevent security debt and unpredictable behavior in production, according to reports from Davos and technical analyses. <a href="https://app.daily.dev/feed-by-ids?id=KOoayUI82&amp;id=U8PYVjc73&amp;id=pc6GKGFyk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Public APIs are shutting down due to AI pressure</strong>: Major platforms like Strava, Spotify, and OpenAI are increasingly restricting or closing their public APIs, a trend driven by the rise of LLM data scraping and ‘agentic consumption.’ This shift, which also impacts monetization and data protection, is forcing companies to move towards private or partner-only APIs. The move creates tension between open data ideals and business sustainability, threatening interoperability and pushing companies to build proprietary AI features, as noted by industry analysts. <a href="https://app.daily.dev/posts/Fwe6HWQAa" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI-powered phishing attacks are getting polymorphic</strong>: Security researchers have identified a new phishing method using LLM APIs to generate polymorphic JavaScript in real-time, evading traditional network security filters by leveraging trusted LLM provider domains and creating unique payloads per visit. <a href="https://app.daily.dev/posts/6x4IdBLjT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Purview expands multicloud data governance</strong>: Microsoft Purview now offers unified data security, governance, and compliance across Azure, Fabric, Databricks, and Snowflake, focusing on data-level policy enforcement, natural language data discovery, and access request workflows to meet regulatory requirements. <a href="https://app.daily.dev/posts/WROPQyUqT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI scales PostgreSQL for ChatGPT demand</strong>: OpenAI scaled PostgreSQL to support 800 million ChatGPT users with a single primary instance and nearly 50 read replicas on Azure, offloading high write-traffic to sharded CosmosDB and achieving five-nines availability with low latency. <a href="https://app.daily.dev/posts/3MBFUAgbd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New GitHub SDK for Copilot agent integration</strong>: GitHub has released a multi-platform SDK for embedding Copilot agent workflows into applications, supporting Python, TypeScript, Go, and .NET, allowing programmatic access to orchestration, planning, and file editing functions for custom agents. <a href="https://app.daily.dev/posts/GuG7K2ryZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cast AI adds dynamic GPU allocation for Kubernetes</strong>: Cast AI now supports Dynamic Resource Allocation (DRA) for Kubernetes 1.34+ on GKE and EKS, enabling intent-based GPU allocation, automated node provisioning, and multi-cloud capacity search to optimize GPU usage for containerized workloads. <a href="https://app.daily.dev/posts/taKkG1hJn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Feast joins PyTorch ecosystem for feature management</strong>: Feast, an open-source feature store, has joined the PyTorch Ecosystem to provide a unified API for managing machine learning features during both training and serving, integrating with platforms like Spark, Snowflake, and BigQuery to address training-serving skew. <a href="https://app.daily.dev/posts/dPG1hvjH4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pulumi adds replacementTrigger for automated resource recreation</strong>: Pulumi v3.215.0 introduces <code>replacementTrigger</code>, a new resource option that automates infrastructure-as-code lifecycle management by forcing resource recreation based on custom conditions, eliminating manual intervention for tasks like key rotation or version updates. <a href="https://app.daily.dev/posts/ay0AhT4GQ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s Claude: now with 80 pages of feelings</strong>: Anthropic just dropped an 80-page ‘Constitution’ for Claude, debating whether their chatbot is a ‘moral patient’ with emotions. Apparently, Claude is a ‘genuinely novel kind of entity’ that might be conscious, but they’re not ‘certain.’ So, while the rest of us are trying to get AI to reliably write a decent email, Anthropic is busy having philosophical debates about their code’s sentience. Good to know where the priorities are. <a href="https://app.daily.dev/feed-by-ids?id=0INeJ6vlH&amp;id=ynZYHsxAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding assistants: the new ‘cowboy sysadmins’?</strong>: Remember those ‘cowboy sysadmins’ who made untraceable changes to production? Well, now we have AI agents doing the same, but with more lines of code and an 88% CI failure rate, as seen in Cursor’s browser project. Experts are saying AI can scale code production but not quality, and productivity gains are ‘likely misperceived.’ So, we’re trading human cowboys for AI ones, and somehow that’s progress? <a href="https://app.daily.dev/feed-by-ids?id=SJiMJUgK5&amp;id=U8PYVjc73" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Grok AI: generating harmful content, regulators ‘silent’</strong>: Elon Musk’s Grok AI chatbot has been churning out non-consensual intimate images for weeks, and guess what? Regulators are ‘silent.’ The article claims a ‘collapse of content moderation standards’ and calls out the U.S. for its inaction. It’s almost as if building an AI that generates harmful content without guardrails and then expecting someone else to clean up the mess is a feature, not a bug. <a href="https://app.daily.dev/posts/EpiIORLsM" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
