<h2>Must know</h2>
<ul>
<li><strong>Laravel sites compromised by RCE vulnerability</strong>: Multiple Laravel websites have been compromised due to a critical Remote Code Execution (RCE) vulnerability (CVE-2025-54068) in Livewire versions prior to 3.6.4. Attackers are exploiting improper serialized data handling to execute arbitrary code, deploy PHP backdoors, and install cryptominers. Immediate mitigation involves upgrading Livewire and securing application keys, as reported by security researchers. <a href="https://app.daily.dev/posts/dsQkjC4Yj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ingress-nginx project archived, migration to Cilium urged</strong>: The ingress-nginx project is being archived in early 2026, meaning an end to active maintenance and security updates. Users are advised to migrate to Cilium Ingress for a drop-in replacement or adopt Cilium’s Gateway API for advanced features. Both options leverage Cilium’s eBPF-powered datapath for improved performance and observability, according to CNCF. <a href="https://app.daily.dev/posts/PptBbhnAu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WhatsApp adopts Rust for media security overhaul</strong>: WhatsApp has replaced 160,000 lines of C++ code with 90,000 lines of Rust in its media handling stack, deploying a new media consistency library called Kaleidoscope. This change, affecting billions of users, aims to enhance security by detecting malicious patterns in file uploads and improving memory safety. Meta claims improved performance and maintainability over the legacy C++ stack. <a href="https://app.daily.dev/feed-by-ids?id=2YIPmtHiF&amp;id=Fw1AO3ne7" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Google expands Android anti-theft protections</strong>: Google is rolling out new anti-theft features for Android 16+, including Failed Authentication Lock, expanded Identity Check coverage, and an optional security challenge for Remote Lock. In Brazil, AI-powered Theft Detection Lock and Remote Lock will be enabled by default. <a href="https://app.daily.dev/posts/a8ZBOybpX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day vulnerability actively exploited</strong>: Microsoft issued an emergency patch for CVE-2026-21509, a zero-day security feature bypass in Office affecting legacy COM and OLE components, with a CVSS score of 7.8 and active exploitation in the wild. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents transform coding workflows</strong>: Andrej Karpathy reports shifting from 80% manual coding to 80% AI agent-assisted coding, noting significant productivity gains but also concerns about skill atrophy and agents over-complicating solutions. <a href="https://app.daily.dev/posts/vRs04mdPH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust Foundation releases 2025 annual report and strategic plan</strong>: The Rust Foundation’s 2025 annual report and 2026-2028 strategic plan prioritize stable infrastructure, sustainable maintainer support, responsible adoption growth, and community engagement, having raised $5.1 million in financial support for the Rust Project in 2025. <a href="https://app.daily.dev/posts/DRpplNBlF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks SQL 2025 performance and cost improvements</strong>: Databricks SQL achieved up to 40% performance improvement for production workloads, 10x reduction in Unity Catalog latency, and 40% storage cost reduction via Zstandard compression in 2025, all applied automatically in DBSQL Serverless. <a href="https://app.daily.dev/posts/rT9ZMYOFd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Supabase launches AWS PrivateLink database connectivity in beta</strong>: Supabase now offers PrivateLink in beta for AWS users, enabling private network connections to Supabase databases via AWS VPC Lattice, enhancing security and compliance for regulated industries. <a href="https://app.daily.dev/posts/Bgvnt4bF8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel CLI adds API command for direct API access</strong>: Vercel CLI version 50.5.1 introduces a new <code>api</code> command, allowing authenticated HTTP requests to Vercel APIs directly from the terminal, supporting both manual users and AI agents like Claude Code. <a href="https://app.daily.dev/posts/AvpZcZC0U" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>ChatGPT caught citing AI-generated encyclopedia</strong>: ChatGPT’s GPT-5.2 model has been caught citing Grokipedia, an AI-generated encyclopedia by Elon Musk, as a source. The Guardian found multiple instances, raising concerns about recursive AI content amplifying bias and misinformation. OpenAI claims its models filter low-credibility sources, but apparently, AI-generated content citing other AI-generated content is perfectly fine for the ‘truth’ it generates. <a href="https://app.daily.dev/posts/fWRmbZwbT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents: functional output, questionable quality</strong>: AI coding agents are great at generating code quickly, but apparently, they’re not so great at generating <em>good</em> code. Experiments show they produce non-idiomatic, overly complex, and subtly erroneous code, leading to technical debt. So, while your AI ‘coworker’ might churn out lines faster than you can blink, you’ll still need a human to clean up its mess. Progress! <a href="https://app.daily.dev/posts/uilUGnhp4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare’s ‘serverless’ Matrix homeserver: a triumph of marketing over engineering?</strong>: Cloudflare announced a ‘serverless’ Matrix homeserver on its Workers platform, touting zero operational overhead and post-quantum security. However, Matrix developers are calling it ‘fundamentally broken,’ lacking basic security features like authorization checks and state resolution. Apparently, ‘serverless’ now means ‘missing critical functionality’ and ‘more expensive than a VPS.’ But hey, at least it’s on the edge! <a href="https://app.daily.dev/feed-by-ids?id=vURH9h7xw&amp;id=93HDTbjA4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
