<h2>Must know</h2>
<ul>
<li><strong>Kubernetes telemetry exploit allows full cluster compromise</strong>: A security researcher uncovered an exploit in Kubernetes’ <code>nodes/proxy GET</code> call that enables privileged command execution and full cluster compromise without leaving audit trails. Despite the severe implications, the Kubernetes team classified this as “intended behavior,” not a bug, and no CVE was issued. A fix, KEP-2862, is planned for Kubernetes 1.36, but until then, administrators must audit RBAC policies and restrict <code>kubelet</code> port access to mitigate the risk, as reported by multiple security outlets. <a href="https://app.daily.dev/posts/bOiz0Chx6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WinRAR vulnerability actively exploited post-patch</strong>: A critical WinRAR vulnerability, CVE-2025-8088, remains actively exploited by various threat actors, including state-sponsored groups and cybercriminals, despite a patch released in July 2025. The path traversal flaw allows attackers to hide malware using Windows Alternate Data Streams, facilitating the deployment of Remote Access Trojans (RATs). This highlights the ongoing challenge of ensuring users apply patches and the sophistication of attackers in finding new exploitation methods, according to security researchers. <a href="https://app.daily.dev/posts/J0xyRLNez" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fortinet discloses critical SSO authentication bypass vulnerability</strong>: Fortinet revealed a new critical authentication bypass vulnerability, CVE-2026-24858, affecting FortiCloud SSO, with a CVSS score of 9.4. Attackers successfully compromised systems already patched for related SSO issues, indicating an alternate attack path. Fortinet confirmed two malicious accounts exploited this flaw in the wild and has disabled FortiCloud SSO connections from vulnerable versions as a mitigation. Patches for most affected versions are still in development, as per Fortinet’s disclosure. <a href="https://app.daily.dev/posts/PBBlJiqf4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Rust Foundation releases 2025 annual report and strategic plan</strong>: The Rust Foundation published its 2025 Annual Report and a 2026-2028 strategic plan focusing on stable infrastructure, maintainer support, adoption growth, organizational engagement, and community building. <a href="https://app.daily.dev/posts/DRpplNBlF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google BigQuery integrates SQL-native AI inference</strong>: Google BigQuery now supports SQL-native managed inference, allowing data teams to deploy and run over 180,000 Hugging Face and Vertex AI models directly via SQL statements, eliminating the need for separate ML infrastructure. <a href="https://app.daily.dev/posts/eM9NtN7mD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Quantum Development Kit updates</strong>: Microsoft announced major updates to its Quantum Development Kit (QDK), including integration with VS Code and GitHub Copilot for AI-assisted quantum programming, and new specialized toolkits for quantum chemistry and error correction. <a href="https://app.daily.dev/posts/0i847vEah" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SERA open-source coding agent announced</strong>: SERA, an open-source coding agent, achieves state-of-the-art performance on SWE-Bench Verified at 54.2% and is affordable to train, costing approximately $400 for reproduction. <a href="https://app.daily.dev/posts/y5jjtMeVw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Klint Rust-based linting tool integration proposed for Linux kernel</strong>: RFC patches were posted for integrating Klint, a Rust-based linting tool, into the Linux kernel to detect issues like incorrect prelude imports and excessive stack frame sizes. <a href="https://app.daily.dev/posts/RgFFWztiy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quarkus 3.31 release details</strong>: Quarkus 3.31 introduces full support for Java 25, a new Maven packaging type for faster builds, Panache Next for improved developer experience, and upgrades to Hibernate ORM and Reactive. <a href="https://app.daily.dev/posts/aOZ3V2uL4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microservices orchestration simulator</strong>: An interactive simulator demonstrates Kubernetes orchestration concepts, including the reconciliation loop, self-healing, horizontal pod autoscaling, and rolling updates, visualizing how declarative infrastructure management maintains desired state. <a href="https://app.daily.dev/posts/VIRS5PfQf" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic CEO advocates minimal AI regulation amid profitability concerns</strong>: Anthropic CEO Dario Amodei penned a 22,000-word essay arguing for minimal AI regulation, primarily focusing on theoretical superintelligent AI risks and advocating for restricting China’s chip access. Critics, however, suggest this is a thinly veiled attempt to resist regulation, especially since Anthropic isn’t expected to be profitable until 2028 and AI model advancement might be slowing. It’s almost as if corporate self-interest sometimes aligns perfectly with the ‘greater good’ of minimal oversight. <a href="https://app.daily.dev/posts/amOI7bITg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Enterprise AI agent rollouts face production challenges</strong>: Apparently, enterprise AI agent implementations are struggling to move from the lab to actual production, with Redis CEO noting fewer production agents than anticipated. The big hurdles? Aggregating unstructured data and replicating human judgment. So, after all the hype, it turns out AI agents need to be, well, intelligent and integrated into messy real-world systems. Who knew that was hard? <a href="https://app.daily.dev/posts/7PYYjzg77" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Moltbot AI assistant faces security and trademark challenges</strong>: Moltbot, the viral open-source personal AI assistant, has achieved over 44,000 GitHub stars, but not without drama. Anthropic forced a name change from Clawdbot due to trademark concerns, and security experts are screaming about critical vulnerabilities like prompt injection and plaintext data storage. Oh, and its GitHub account was hijacked by crypto scammers. It’s almost like building a secure, reliable AI assistant that autonomously manages your life is harder than just making it ‘viral.’ <a href="https://app.daily.dev/posts/zkO1JWwHu" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
