<h2>Must know</h2>
<ul>
<li><strong>Kubernetes telemetry exploit allows full cluster compromise</strong>: A security researcher uncovered an exploit in Kubernetes’ <code>nodes/proxy GET</code> call that enables privileged command execution and full cluster compromise without leaving audit trails. Despite the severe implications, the Kubernetes team classified this as “intended behavior,” not a bug, and no CVE was issued. A fix, KEP-2862, is planned for Kubernetes 1.36, but until then, administrators are advised to audit RBAC policies and restrict <code>kubelet</code> port access to mitigate the risk, as reported by various security outlets. <a href="https://app.daily.dev/posts/bOiz0Chx6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WinRAR vulnerability actively exploited post-patch</strong>: A critical WinRAR vulnerability, CVE-2025-8088, remains actively exploited by various threat actors, including state-sponsored groups and cybercriminals, despite a patch released in July 2025. This path traversal flaw allows attackers to hide malware using Windows Alternate Data Streams, facilitating the deployment of Remote Access Trojans (RATs). The exploit, initially sold for $80,000 on cybercrime forums, continues to target military, government, and commercial entities globally, according to security researchers. <a href="https://app.daily.dev/posts/J0xyRLNez" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fortinet discloses critical SSO authentication bypass vulnerability</strong>: Fortinet has disclosed a new critical authentication bypass vulnerability, CVE-2026-24858, affecting FortiCloud SSO with a CVSS score of 9.4. This flaw allowed attackers to compromise systems even after previous SSO patches, indicating an alternate attack path. Fortinet confirmed two malicious accounts exploited this in the wild and has disabled FortiCloud SSO connections from vulnerable versions, with patches for most affected versions still in development. <a href="https://app.daily.dev/posts/PBBlJiqf4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Rust Foundation releases 2025 annual report and 2026-2028 strategic plan</strong>: The Rust Foundation released its 2025 Annual Report, detailing financial support for the Rust Project, and outlined a 2026-2028 strategic plan focusing on stable infrastructure, maintainer support, adoption growth, and community engagement. <a href="https://app.daily.dev/posts/DRpplNBlF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google releases TranslateGemma open-source translation models</strong>: Google launched TranslateGemma, an open-source translation model suite built on the Gemma 3 architecture, offering 4B, 12B, and 27B parameter variants supporting 55 languages, with the 12B model outperforming the 27B baseline on WMT24++ benchmarks. <a href="https://app.daily.dev/posts/Fvt1eqDgo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google BigQuery integrates SQL-native AI inference</strong>: Google BigQuery now supports SQL-native managed inference, allowing data teams to deploy and run over 180,000 Hugging Face and Vertex AI models directly via SQL statements, eliminating the need for separate ML infrastructure. <a href="https://app.daily.dev/posts/eM9NtN7mD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SERA open-source coding agent announced</strong>: SERA, an open-source coding agent, achieves state-of-the-art performance on SWE-Bench Verified at 54.2% and is affordable to train (around $400), matching or exceeding 100B+ parameter models on specific repositories. <a href="https://app.daily.dev/posts/y5jjtMeVw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Mousefood: Ratatui backend for embedded TUIs</strong>: Mousefood is a <code>no-std embedded-graphics backend</code> for <code>Ratatui</code>, enabling terminal user interfaces (TUIs) on embedded devices like ESP32 and RP2040, with support for e-ink displays and custom fonts. <a href="https://app.daily.dev/posts/VkLfUCNej" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Klint Rust-based linting tool integration proposed for Linux kernel</strong>: RFC patches have been posted to integrate Klint, a Rust-based linting tool, into the Linux kernel to detect issues like incorrect prelude imports and excessive stack frame sizes, functioning as a custom Rust compiler driver. <a href="https://app.daily.dev/posts/RgFFWztiy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>P2P &amp; BitTorrent simulator overview</strong>: An interactive simulator demonstrates BitTorrent and P2P file sharing mechanics, explaining core concepts like seeders, leechers, trackers, and the rarest-first strategy, and highlighting real-world applications in blockchain and IPFS. <a href="https://app.daily.dev/posts/N9MgEmbpx" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic CEO argues for minimal AI regulation while company struggles for profit</strong>: Anthropic CEO Dario Amodei penned a 22,000-word essay advocating for minimal AI regulation, focusing on theoretical superintelligent AI risks and suggesting restricting China’s chip access. Critics, however, point out that this conveniently ignores present concerns like wealth inequality and job displacement, especially as Anthropic isn’t expected to be profitable until 2028. It’s almost as if the ‘future of humanity’ takes a backseat when the balance sheet is looking a bit thin, as reported by various outlets. <a href="https://app.daily.dev/posts/amOI7bITg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Moltbot AI assistant: A security nightmare wrapped in hype</strong>: Moltbot, the viral open-source AI assistant, has garnered over 44,000 GitHub stars, but it’s also a security dumpster fire. From prompt injection vulnerabilities that allow arbitrary command execution to plaintext storage of sensitive data and a hijacked GitHub account, this tool is a hacker’s dream. Security experts are screaming for users to set it up on isolated systems, not their primary computers, yet the hype machine keeps churning, as if convenience trumps basic security, according to multiple reports. <a href="https://app.daily.dev/posts/zkO1JWwHu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-powered polymorphic phishing: Because regular phishing wasn’t annoying enough</strong>: Apparently, phishing attacks are getting an AI upgrade, with new polymorphic attacks using DeepSeek and Gemini to dynamically generate malicious JavaScript directly in victims’ browsers. This ‘last mile reassembly’ technique supposedly bypasses traditional security by splitting malware into fragments, making it sound like some super-sophisticated spy movie plot. In reality, it’s just another way for bad actors to make our lives harder, proving that if you give AI a tool, it’ll find a way to use it for evil, as detailed in various cybersecurity reports. <a href="https://app.daily.dev/posts/jfmiKNwaJ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
