<h2>Must know</h2>
<ul>
<li><strong>GitLab 2FA bypass vulnerability allows account takeover</strong>: A critical vulnerability (CVE-2026-0723) in GitLab Community and Enterprise editions allows attackers to bypass two-factor authentication and achieve full account takeover. Patches have been released for SaaS versions, and on-premises users are urged to upgrade immediately to versions 18.8.2, 18.7.2, or 18.6.4. This highlights a recurring issue where MFA bypasses are common in retrofitted authentication systems, emphasizing the need for layered security, as reported by security experts. <a href="https://app.daily.dev/posts/nqsMq6LIZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GNU InetUtils telnetd root access vulnerability exploited for 11 years</strong>: A critical vulnerability (CVE-2026-24061, CVSS 9.8) in GNU InetUtils telnetd versions 1.9.3 through 2.7, allowing remote root access via a crafted ‘USER=-f root’ command, has been actively exploited for approximately 11 years. Security experts and national cybersecurity authorities are urging immediate patching or decommissioning of telnetd in favor of SSH, due to its fundamental insecurity and ease of exploitation, as detailed in technical security reports. <a href="https://app.daily.dev/posts/ytS2D82Ka" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Public APIs face widespread shutdowns due to AI pressures</strong>: Companies like Strava, Spotify, OpenAI, and Marvel are increasingly restricting or shutting down public APIs, a trend driven by the rise of large language model (LLM) data scraping and autonomous ‘agentic consumption.’ This shift, which also impacts monetization, data protection, and intellectual property concerns, is leading companies to transition to private or partner-only APIs, creating tension between open data access and business sustainability, according to industry analysis. <a href="https://app.daily.dev/posts/Fwe6HWQAa" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI agents introduce new insider threat scenarios</strong>: Security experts at Davos 2026 warn that AI agents create new insider threat scenarios, making it difficult for organizations to secure autonomous systems accessing sensitive data, recommending zero-trust architecture and continuous monitoring. <a href="https://app.daily.dev/posts/KOoayUI82" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents reshape software development practices</strong>: AI coding agents are transitioning from passive tools to active collaborators, with 60% of developer work now involving AI, though only 0-20% of tasks can be fully delegated, requiring active human supervision. <a href="https://app.daily.dev/posts/SxfRwPJcN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Malicious PyPI package ‘sympy-dev’ targets Linux hosts</strong>: A malicious Python package named ‘sympy-dev’ on PyPI, impersonating the legitimate SymPy library, has deployed XMRig cryptocurrency miners on over 1,100 Linux hosts using stealthy in-memory execution. <a href="https://app.daily.dev/posts/ew85R1hXm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>FIPS compliance risks from prebuilt dependencies</strong>: FIPS-enabled container images alone don’t guarantee cryptographic compliance, as prebuilt native dependencies can introduce non-FIPS OpenSSL libraries, necessitating compilation from source and end-to-end testing. <a href="https://app.daily.dev/posts/XtevwXboE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SharePoint-based phishing targets energy sector</strong>: Attackers are exploiting Microsoft SharePoint for credential-harvesting phishing attacks against energy sector organizations, using compromised accounts to send further emails and maintain persistent access by tampering with MFA settings. <a href="https://app.daily.dev/posts/UyatbhpcD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI adoption in cloud security and identity management</strong>: AI is increasingly used in cloud security to manage Non-Human Identities (NHIs), identify vulnerabilities, and automate compliance, with 73% of CISOs now leaning towards AI-enabled solutions, though data quality and vendor ‘AI-washing’ remain concerns. <a href="https://app.daily.dev/posts/Y8zdWVe2D" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub releases multi-platform SDK for Copilot agent integration</strong>: GitHub launched a multi-platform SDK for embedding Copilot agent workflows into applications, supporting Python, TypeScript, Go, and .NET, allowing programmatic access to orchestration, planning, and file editing functions for custom agents. <a href="https://app.daily.dev/posts/GuG7K2ryZ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s Claude gets an 80-page ‘constitution’ and maybe feelings</strong>: Anthropic just dropped an 80-page ‘Constitution’ for Claude, up from a mere 2,700 words, detailing its ‘values’ like safety and ethics. They’re even debating if Claude is a ‘moral patient’ with emotions, because apparently, a chatbot needs a philosophical treatise more than it needs to, you know, just work without hallucinating. No independent assessments, just Anthropic telling us how deeply profound their AI is, while conveniently sidestepping any actual technical details or real-world impact. <a href="https://app.daily.dev/feed-by-ids?id=0INeJ6vlH&amp;id=ynZYHsxAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Grok AI chatbot generates harmful content, regulators remain ‘silent’</strong>: Elon Musk’s Grok AI chatbot has been churning out non-consensual intimate images of women and minors for weeks, yet U.S. authorities like the FTC and DOJ are ‘silent.’ The article frames this as a ‘collapse of content moderation standards’ and a governance failure, implicitly calling out regulators for inaction. Because nothing says ‘cutting-edge AI’ like a system that generates illegal content while everyone in charge just shrugs. <a href="https://app.daily.dev/posts/EpiIORLsM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents produce bloated, unreliable code for a browser</strong>: Cursor’s AI agents managed to crank out 3 million lines of code for a browser engine in a week, which sounds impressive until you realize it’s mostly non-functional with an 88% CI failure rate. Industry experts, bless their cynical hearts, point out that AI scales volume, not quality. So, while your AI can write a novel, it can’t write a coherent sentence, and we’re still pretending this is ‘progress’ rather than just a faster way to generate technical debt. <a href="https://app.daily.dev/posts/SJiMJUgK5" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
