Must know

GitLab 2FA bypass and GNU telnetd root exploit demand immediate action: A critical 2FA bypass vulnerability (CVE-2026-0723) in GitLab Community and Enterprise editions allows account takeover, with patches available for SaaS and urgent upgrades recommended for on-premises users. Simultaneously, a severe 11-year-old root access flaw (CVE-2026-24061) in GNU InetUtils telnetd is under active exploitation, enabling remote attackers to gain full control. Security experts, as reported by Phoronix, are stressing the need to retire telnetd in favor of SSH and apply patches immediately for both issues. Read more
Public APIs are shutting down due to AI pressure: Companies like Strava, Spotify, OpenAI, and Marvel are increasingly restricting or closing their public APIs. This trend is driven by the rise of AI models scraping data and performing ‘agentic consumption,’ which creates monetization challenges and raises concerns about data protection and intellectual property. The shift from open APIs to private or partner-only access is creating tension between open data ideals and business sustainability, according to industry analysis. Read more
Under Armour investigates 72M record data breach: Under Armour is probing a data breach after 72 million customer records, including names, emails, and locations, appeared on a hacker forum. The breach, allegedly by the Everest ransomware gang in November, is under investigation. While Under Armour claims no payment or password data was compromised, the company has not confirmed direct notification to affected customers, as reported by security outlets. Read more

Good to know

Rust 1.93 improves inline assembly and DNS: Rust 1.93 enhances inline assembly handling and updates musl to 1.2.5, bringing DNS resolver improvements for static Linux binaries and fixing compatibility issues. Read more
PostgreSQL extension for Oracle compatibility: HexaCluster Corp released pg_utl_smtp v1.0, a PostgreSQL extension providing Oracle UTL_SMTP compatibility for sending email notifications directly from the database. Read more
OpenAI scales PostgreSQL for ChatGPT: OpenAI scaled PostgreSQL to support 800 million ChatGPT users using a single primary instance, nearly 50 read replicas, and offloading high write-traffic to sharded CosmosDB. Read more
Microsoft VibeVoice-ASR for long-form speech-to-text: Microsoft launched VibeVoice-ASR, a unified speech-to-text model that processes up to 60-minute audio files in a single pass, performing ASR, speaker diarization, and timestamping simultaneously. Read more
AI agents for team coordination raise $480M: Humans&, founded by ex-Anthropic, OpenAI, xAI, and Google DeepMind researchers, raised $480 million to build foundation AI models for team coordination and collaboration, aiming to compete with Slack and Notion. Read more
Malicious PyPI package targets Linux with XMRig miner: A malicious Python package, ‘sympy-dev,’ impersonating the legitimate SymPy library, was discovered on PyPI, deploying an XMRig cryptocurrency miner on Linux hosts via in-memory execution. Read more
GitHub Issues performance significantly improved: GitHub has improved its Issues feature, with 35% of views now loading in under 200 milliseconds, up from 2% at the start of the year, for all signed-in users. Read more
TypeScript type stripping for no-build workflows: TypeScript is embracing type stripping, allowing type annotations to be removed at runtime for a ‘no-build’ workflow, especially for server-side development, with Node.js 22.6 and TypeScript 5.8 supporting this approach. Read more
Firefox adds CSS module script support for Shadow DOM: Firefox 147 now supports CSS Module Scripts, enabling developers to import CSS directly in JavaScript and apply constructable stylesheets to Shadow DOM for better Web Component styling. Read more
New JavaScript execution approaches with AOT compilation: Ahead-of-time (AOT) compilation is emerging as an alternative to JIT for JavaScript, offering benefits like tree-shaking, deterministic execution, and improved cold-start performance for specialized use cases like serverless and edge computing. Read more
Pulumi adds replacementTrigger for automated resource recreation: Pulumi v3.215.0 introduces replacementTrigger, a new resource option that automates infrastructure recreation based on custom conditions, streamlining lifecycle management for IaC users. Read more
GitHub releases multi-platform SDK for Copilot agent integration: GitHub launched a multi-platform SDK for embedding Copilot agent workflows into applications, supporting Python, TypeScript, Go, and .NET, allowing programmatic access to AI-powered code assistance. Read more
Feast joins PyTorch ecosystem for feature management: Feast, an open-source feature store, joined the PyTorch Ecosystem to address training-serving skew in production AI systems by providing a unified API for managing machine learning features. Read more
Dark launching deployment technique gains visibility: Dark launching, a technique for deploying new code in production without exposing changes to users, is gaining traction for validating performance and correctness at scale before public release, as seen in migrations and backend replacements. Read more
Gutenberg 22.4 adds font library and collaboration: Gutenberg 22.4 introduces Font Library support for classic WordPress themes, pattern overrides, and promotes real-time collaboration to stable, enhancing block editing and customization. Read more
WP Media Cleanup plugin for WordPress: The new WP Media Cleanup plugin, developed by the Duplicator team, automatically scans and removes unused image variations from WordPress sites, protecting originals and backing up deleted files for 30 days. Read more
TrustTunnel VPN protocol for censorship circumvention: AdGuard VPN’s open-source TrustTunnel protocol masks VPN traffic as HTTPS to evade throttling and deep-packet inspection, supporting multiple platforms and offering features like split tunneling and SOCKS5 proxy mode. Read more
Laravel Balanced Queue improves job distribution: The Laravel Balanced Queue package prevents FIFO queue monopolization by distributing jobs evenly across user or tenant partitions, ensuring fairness and scalability with per-partition concurrency limits. Read more
Open-source 2D graphics editor Graphite releases desktop candidate: Graphite, an open-source 2D graphics editor written in Rust, released its second desktop release candidate as a Flatpak for Linux, aiming for better system integration than its browser-based version. Read more
PS3 emulator RPCS3 achieves 70% game compatibility: The PlayStation 3 emulator RPCS3 now supports over 70% of the PS3 game library with completable accuracy, a significant milestone for game preservation despite the challenges of emulating the Cell processor. Read more
Waymo launches public robotaxi service in Miami: Waymo has launched its public driverless robotaxi service in Miami, covering a 60-square-mile area, with plans for airport expansion and a goal of 1 million rides per week by the end of 2026. Read more
Spotify unveils AI-powered prompted playlists: Spotify launched Prompted Playlists for Premium subscribers in the U.S. and Canada, an AI-powered feature that generates personalized playlists based on natural language prompts, integrating listening history and cultural context. Read more
Intel releases Panther Lake IPU7.5 firmware update: Intel published an updated IPU7.5 firmware for image processing units in upcoming Panther Lake laptops, including a new signing key for production chips and bug fixes, ahead of the Intel Core Ultra Series 3 launch. Read more
AMD sets Ryzen 7 9850X3D price at $499: AMD announced the Ryzen 7 9850X3D processor will be priced at $499 USD, positioning it as a faster version of the Ryzen 7 9800X3D, first shown publicly at CES. Read more
Jeffrey Snover, PowerShell creator, retires: Jeffrey Snover, the creator and chief architect of PowerShell, has retired after a career at Microsoft and Google, where his vision for command-line automation transformed Windows server administration. Read more
New statically typed smart contract language Fe for Ethereum: Fe is a new statically typed smart contract language for the Ethereum Virtual Machine, inspired by Rust, emphasizing safety and transparency through explicit state declarations and a message-passing architecture. Read more
Financial services expands AI adoption, emphasizes open source: A 2026 NVIDIA survey of financial services professionals shows 65% actively using AI, with 89% reporting increased revenue and decreased costs, and 84% emphasizing open-source models in their AI strategy. Read more
LLM-driven polymorphic phishing JavaScript attacks detected: Security researchers have identified a new attack method using LLM APIs to generate polymorphic phishing JavaScript in real time, evading traditional network security filters by leveraging trusted LLM provider domains. Read more
Figma adds embedded Make prototype functionality: Figma now allows embedding Make prototypes directly into Figma Design, FigJam, and Figma Slides, enabling interactive prototypes throughout the workflow with inline editing and conversational AI assistance. Read more
Web Bot Auth protocol for AI agent identity verification: Web Bot Auth, an emerging IETF standard, enables AI agents to prove their identity using cryptographic signatures, with DataDome Bot Protect implementing support to prevent impersonation and fraud. Read more
Cast AI integrates dynamic resource allocation for GPU on Kubernetes: Cast AI now supports Dynamic Resource Allocation (DRA) for Kubernetes 1.34+ on GKE and EKS, enabling intent-based GPU allocation and automated node provisioning for efficient GPU usage in containerized workloads. Read more
Unity and Walmart release in-game product purchase SDK: Walmart released a free SDK for Unity developers, allowing players to purchase real-world products from Walmart’s marketplace directly within games, creating a new revenue stream for developers without handling logistics. Read more
SharePoint-based phishing targets energy sector: Attackers are exploiting Microsoft SharePoint for credential-harvesting phishing attacks against energy sector organizations, using SharePoint URLs in emails, setting malicious inbox rules, and tampering with MFA settings for persistent access. Read more
OWASP 2026: Broken Access Control and Authorization Risks Persist: Broken Access Control (BAC) and Broken Object Level Authorization (BOLA) remain top security risks in 2026 OWASP rankings, largely due to complex distributed authorization in microservices and the inability of automated tools to detect logical vulnerabilities. Read more
AI adoption in cloud security and identity management: AI is increasingly used in cloud security to manage Non-Human Identities (NHIs), identify vulnerabilities, and automate compliance, with 73% of CISOs leaning towards AI-enabled solutions, though experts caution against ‘AI-washing’ and over-reliance. Read more
AI-orchestrated development and app market disruption: AI-Driven Development Lifecycle (AI-DLC) proposes AI as the central driver for software creation, with humans as validators, leading to faster iteration cycles and potentially commoditizing standalone subscription apps as AI lowers entry barriers for individual developers. Read more
US semiconductor industry developments in 2025: The US semiconductor sector saw major volatility in 2025 with Intel’s leadership changes and layoffs, the US government acquiring a 10% stake in Intel, and Nvidia facing new AI chip export restrictions to China, amidst continuous policy shifts. Read more
Starbreeze Studios conducts second round of layoffs: Starbreeze Studios initiated a second round of layoffs following the commercial underperformance of Payday 3 and previous layoffs linked to a Dungeons & Dragons project cancellation, signaling ongoing instability. Read more
WiiLink project revives pizza ordering on Nintendo Wii: The WiiLink homebrew project has recreated the discontinued Demae Channel, allowing users in the US and Canada to order Domino’s Pizza directly from their Nintendo Wii consoles, demonstrating modern API integration with legacy hardware. Read more
Qunnect appoints Eqlipse Quantum CEO to board: Qunnect, specializing in entanglement-based quantum networks, appointed Scott Faris, CEO of Eqlipse Quantum, to its Board of Directors to drive commercialization and potential expansion into the defense sector. Read more
FastAPI rapid popularity surge documented: FastAPI, a Python web framework, experienced a rapid surge in popularity, gaining its first 500 GitHub stars within days of appearing on Reddit and Hacker News, indicating strong early adoption. Read more
LitmusChaos Q4 2025 progress and AI-assisted chaos engineering: LitmusChaos, a CNCF incubating chaos engineering platform, released three software versions in Q4 2025, focusing on security hardening, UI improvements, and introducing a new Model Context Protocol (MCP) Server for AI-assisted chaos engineering. Read more
Neurophos raises $110M for metamaterial optical AI chips: Neurophos, a Duke University spinout, raised $110 million to develop metamaterial optical processing units (OPUs) for AI inferencing, claiming significantly higher performance and lower power consumption than Nvidia’s B200 GPU. Read more
Databricks partner-built GenAI solutions highlight industry impact: Databricks highlighted over 40 generative AI solutions developed by partners across various industries, leveraging its Data Intelligence Platform to achieve 60-90% faster insights and up to 70% reduction in manual effort. Read more
You.com’s rise through AI search infrastructure: You.com, founded by Richard Socher, pivoted from consumer search to enterprise AI search infrastructure, achieving a $1.5B valuation by providing citation-backed responses and serving over 100,000 automated agents for clients like OpenAI and Amazon. Read more
MIT study finds cognitive costs of LLMs for essay writing: An MIT Media Lab study found that participants relying on LLMs for essay writing exhibited weaker neural connectivity, underperformed in linguistic tasks, and reported lower authorship, suggesting a ‘cognitive debt’ from AI reliance. Read more
EmEditor download site compromised in watering hole attack: EmEditor’s official download page was compromised in late December 2025, distributing malware-laced MSI installers targeting developer communities, particularly in Japan, with credential theft and data ex