Must know

Kubernetes exploit allows full cluster compromise: A security researcher found an exploit in Kubernetes’ nodes/proxy GET call that allows privileged command execution and full cluster compromise without audit trails. The Kubernetes team, however, classified this as ‘intended behavior,’ not a bug, which is a bit concerning. This vulnerability affects 69 monitoring tools, and while a fix is planned for Kubernetes 1.36, it’s not out yet. Admins should audit RBAC policies and restrict kubelet port access to mitigate the risk, as reported by multiple security outlets. Read more
Fortinet discloses critical SSO authentication bypass: Fortinet has disclosed a critical authentication bypass vulnerability, CVE-2026-24858, affecting FortiCloud SSO with a CVSS score of 9.4. This flaw allowed attackers to compromise systems even after previous SSO patches, indicating a new attack vector. Fortinet confirmed two malicious accounts exploited this in the wild and has disabled FortiCloud SSO connections from vulnerable versions. Patches are still in development for most affected products, including FortiAnalyzer, FortiManager, FortiOS, and FortiProxy. Read more
AI-powered polymorphic phishing attack emerges: A new polymorphic phishing attack uses AI models like DeepSeek and Gemini to dynamically generate malicious JavaScript code directly in victims’ browsers. This technique bypasses traditional security by splitting malware into fragments delivered via separate AI prompts and reassembling them client-side from trusted LLM domains, a process called ‘last mile reassembly.’ This highlights the increasing use of AI in offensive security, making user awareness more critical than ever. Read more

Good to know

Google BigQuery integrates SQL-native AI inference: Google BigQuery now supports SQL-native managed inference, allowing data teams to deploy and run over 180,000 Hugging Face and Vertex AI models directly via SQL statements, eliminating the need for separate ML infrastructure. Read more
Microsoft updates Quantum Development Kit: Microsoft announced major updates to its Quantum Development Kit (QDK), including integration with VS Code and GitHub Copilot for AI-assisted quantum programming, and new specialized toolkits for quantum chemistry and error correction. Read more
Dynatrace launches AI observability app and agentic operations platform: Dynatrace released its AI Observability app and a new agentic operations platform, providing end-to-end visibility for agent interactions, tool usage, token consumption, and errors across major cloud providers, aiming for autonomous operations. Read more
Google launches agentic vision for Gemini 3 Flash: Google introduced Agentic Vision for Gemini 3 Flash, transforming static image processing into interactive investigation by combining visual reasoning with Python code execution for tasks like image annotation and high-density table parsing. Read more
Rust Foundation releases 2025 annual report and strategic plan: The Rust Foundation released its 2025 Annual Report and a 2026-2028 strategic plan focusing on stable infrastructure, maintainer support, adoption growth, organizational engagement, and building global communities for the Rust Project. Read more
Firefox and Windows 11 release updates: Firefox 147 shipped with major web platform features like Navigation API and CSS Anchor Positioning, while Windows 11 Insider Preview Build 26300.7674 includes fixes for File Explorer and Start menu issues. Read more
OpenSilver 3.3 integrates Blazor into XAML applications: OpenSilver 3.3 now allows Blazor components to run directly within XAML applications, supporting .NET 10 and C# 14, and offering a modernization path for legacy Silverlight and WPF apps. Read more
Quarkus 3.31 released with Java 25 support: Quarkus 3.31 is out, bringing full support for Java 25, a new Maven packaging type for faster builds, Panache Next for improved developer experience, and upgrades to Hibernate ORM and Reactive. Read more
Hugo v0.155.0 released with bug fixes and new features: Hugo, the static site generator, released version 0.155.0, which includes bug fixes for data races and partial rendering, enhanced image metadata support, and native WebP image decoding. Read more
Klint Rust-based linting tool proposed for Linux kernel: RFC patches have been posted to integrate Klint, a Rust-based linting tool, into the Linux kernel to detect issues like incorrect prelude imports and excessive stack frame sizes, similar to Clippy. Read more
Microservices pitfalls and modular monolith recommendation: An article argues that microservices primarily address organizational problems and recommends starting with a well-structured modular monolith, using event storming to identify proper service boundaries. Read more
Enterprise database and invalidation pipeline scaling strategies: Asana scaled its invalidation pipeline for near-realtime reactivity using MySQL binlog change-data-capture, while Agoda scaled its ScyllaDB-backed feature store to handle 50x traffic growth with 10ms P99 latencies. Read more
Cloud providers announce 2025/2026 service enhancements: Google Cloud Spanner evolved into an intelligent context hub for AI applications, AWS CloudFormation introduced major enhancements for accelerating development, and .NET 10 is now available on AWS Lambda as a managed runtime. Read more
Werf: A decade of Kubernetes software delivery tool evolution: Werf, an opinionated CLI tool for building container images and deploying to Kubernetes, has evolved into a CNCF Sandbox project used in 18,000 projects worldwide, enforcing best practices for software delivery. Read more
Microservices orchestration simulator: An interactive simulator demonstrates Kubernetes orchestration concepts like the reconciliation loop, self-healing, horizontal pod autoscaling, and rolling updates, visualizing declarative infrastructure management. Read more
Shadcn Astro Ink landing page template: Shadcn Studio offers an open-source landing page template built with Astro and Tailwind CSS, featuring pre-built components, TypeScript support, responsive design, and optimized performance for static hosting. Read more
ng-forge: Type-safe, signal-based dynamic forms for Angular: ng-forge is a new Angular library that provides configuration-driven dynamic form generation with full TypeScript type inference, declarative validation, conditional logic, and multi-page wizard support. Read more
WinRAR vulnerability CVE-2025-8088 actively exploited post-patch: A critical WinRAR vulnerability, CVE-2025-8088, a path traversal flaw allowing malware deployment via Windows Alternate Data Streams, remains actively exploited by various threat actors despite a patch released in July 2025. Read more
UK tribunal approves antitrust lawsuit against Valve: A UK tribunal approved a collective action lawsuit against Valve, representing 14 million UK Steam users, alleging Valve maintains a monopoly through ‘Platform Parity Obligations’ and excessive 30% commission fees. Read more
Samsung previews Galaxy privacy display feature: Samsung previewed a new privacy feature for Galaxy smartphones that prevents ‘shoulder surfing’ by controlling screen visibility based on viewing angle, expected to launch with the Galaxy S26 series. Read more
AMD Ryzen 7 9850X3D processor launch and performance review: AMD launched the Ryzen 7 9850X3D processor for $499, featuring an 8-core/16-thread configuration and 104MB cache, excelling in gaming and general desktop tasks according to Linux benchmarks. Read more
FreeType LCD filter rendering performance improvement: The FreeType library has implemented a 40% performance improvement for LCD filter rendering, particularly effective at 32 pixels per em, by applying the filter to spans instead of the entire image. Read more
Mousefood: Ratatui backend for embedded TUIs: Mousefood is a no-std embedded-graphics backend for Ratatui, enabling terminal user interfaces (TUIs) on embedded devices like ESP32, STM32, and RP2040, with support for e-ink displays and custom fonts. Read more
SonicDE forks KDE for X11 preservation: SonicDE, formerly KDE-Lite, is forking the KDE desktop environment to preserve and maintain X11-specific code, directly responding to Plasma 6.8’s plan to become Wayland-exclusive and discontinue X11 session support. Read more
P2P & BitTorrent simulator overview: An interactive simulator demonstrates BitTorrent and P2P file sharing mechanics, explaining core concepts like seeders, leechers, trackers, and the rarest-first strategy, and highlighting real-world applications in blockchain and WebRTC. Read more
HMRC plans £2B tech spend amid modernization challenges: HMRC plans over £2 billion in technology procurement over the next two years, including a £410 million data warehouse transformation and £350 million for AWS cloud compute, despite struggling to modernize legacy systems and facing higher-than-expected costs. Read more
Luminar bankruptcy sale to MicroVision approved: Luminar’s lidar business was sold to MicroVision for $33 million, approved despite a last-minute, substantially higher bid from Luminar’s founder that had ‘unspecified issues’ preventing its acceptance. Read more
SpaceX plans June 2026 IPO targeting $1.5 trillion valuation: SpaceX is reportedly planning an IPO for June 2026, aiming to raise at least $50 billion with a target valuation of $1.5 trillion, to support Starship development and Mars mission goals. Read more
Jagex shifts RuneScape strategy: Jagex is making an eight-figure investment in RuneScape, shifting its strategy to focus on the game’s ‘British identity’ and community-driven development, including removing the Treasure Hunter microtransaction system. Read more
Netflix invests in Blender open-source 3D software: Netflix Animation Studios donated €240,000 to the Blender Foundation, becoming a Corporate Patron to support core development of the open-source 3D software, especially for media and entertainment workflows. Read more
Crashsune releases free Blender character tutorials: 3D artist Crashsune released free Blender tutorials and downloadable materials for creating stylized animated characters, covering models like BIRDBRAIN Teto and low-poly Carmelita Fox. Read more
TexturingXYZ SKAP beta release: TexturingXYZ is launching Phase 2 of its SKAP tool, an online platform for generating production-ready skin texture maps, with private beta access rolling out soon to waitlisted users. Read more
Epic Games releases internal MetaSounds tools: Epic Games released TechAudioTools, a free content plug-in containing internal audio tools previously used for MetaSounds workflows in Fortnite, to provide editor utilities for working with MetaSounds at scale in Unreal Engine 5. Read more
WebGPU water demo extended with Apple Vision Pro XR support: James C. Kane extended Yong Su’s WebGPU water simulation demo with Apple Vision Pro XR support, adding new input methods like Gaze and Pinch for eye-tracked 3D object selection and movement. Read more
Smoothie bikes converted to game controllers for college: A maker converted exercise smoothie bikes into game controllers using an ESP32 microcontroller and a light sensor to track RPM, connecting via WiFi to a Raspberry Pi running the game. Read more
Microsoft Fabric Capacity Metrics app error identified and resolved: The Microsoft Fabric Capacity Metrics app displays a ‘NoCapacitiesInRegion’ error when a Power BI Pro capacity is assigned instead of a Fabric capacity, which can be resolved by switching to a Fabric capacity. Read more
Anduril invents drone flying contest where jobs are the prize: Defense tech company Anduril is launching the AI Grand Prix, an autonomous drone racing competition where software engineers program drones to fly themselves, offering prizes up to $500,000 and job opportunities. Read more
AWS Deadline Cloud now supports editing job name and description: AWS Deadline Cloud now allows users to edit job names and descriptions after job submission, helping teams organize and track jobs more effectively by adding details like shot and sequence numbers. Read more
Richard Geldreich’s blog: bc7f: A new real-time analytical BC7 encoder: bc7f is a new real-time BC7 texture encoder that uses analytical, statistics-driven error prediction instead of iterative search, achieving O(1) bounded time complexity and significantly faster performance than previous methods. Read more
Stop sifting logs: Find production errors in seconds with severity=error: AppSignal has upgraded its log query language with advanced filtering capabilities, including AND/OR logic and JSON dot notation, enabling precise queries and a redesigned UI for log inspection and automatic attribute detection. Read more
Vendor lock-in vs strategic partnership for your CI/CD: Vendor lock-in in CI/CD is often unavoidable, so the focus should be on evaluating whether a vendor becomes a strategic partner by assessing technical, financial, operational, and strategic risks through a practical questionnaire framework. Read more
Machine learning in production? What this really means: Putting machine learning models into production involves creating systems where model outputs directly impact users, requiring a prediction function, API interface, Docker packaging, accessible infrastructure, and monitoring for drift and performance. Read more
If it’s not accessible, it’s not design: Accessibility is a legal requirement, not optional, with laws like WCAG 2.2 mandating accessible digital products, and designing for disabilities benefits everyone by reducing support tickets, cutting onboarding time, and improving form completion rates. Read more
Try text scaling support in Chrome Canary: Chrome Canary now supports a new HTML meta tag for text scaling, allowing websites to respect users’ system-level text size preferences, which requires opt-in and proper use of font-relative units for optimal display. Read more
When progress actively kills momentum: Real project momentum comes from stakeholder alignment and shared understanding, not just task completion, with visual artifacts like designs and diagrams unlocking alignment faster than documents. Read more
Understanding TypeProf: Design goals, limitations, and effective use in Ruby: TypeProf is a type inference engine for Ruby designed to infer method signatures and generate RBS definitions, acting as infrastructure for typed Ruby adoption rather than a strict type checker. Read more