<h2>Must know</h2>
<ul>
<li><strong>Kubernetes telemetry exploit allows full cluster compromise</strong>: A security researcher uncovered an exploit in Kubernetes’ <code>nodes/proxy GET</code> call that enables privileged command execution and full cluster compromise without leaving audit trails. Despite the severe implications, the Kubernetes team classified this as “intended behavior,” not a bug, and no CVE was issued. A fix, KEP-2862, is planned for Kubernetes 1.36, but until then, administrators should audit RBAC policies and restrict <code>kubelet</code> port access to mitigate the risk, as reported by Security Boulevard. <a href="https://app.daily.dev/posts/bOiz0Chx6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WinRAR vulnerability actively exploited post-patch</strong>: A critical WinRAR vulnerability, CVE-2025-8088, remains actively exploited by various threat actors, including state-sponsored groups and cybercriminals, despite a patch released in July 2025. This path traversal flaw allows attackers to hide malware using Windows Alternate Data Streams, facilitating the deployment of Remote Access Trojans (RATs). Targets include Ukrainian military, government entities, and commercial organizations, highlighting the persistent danger of unpatched or poorly patched software, according to Security Boulevard. <a href="https://app.daily.dev/posts/J0xyRLNez" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fortinet discloses critical SSO authentication bypass vulnerability</strong>: Fortinet revealed a new critical authentication bypass vulnerability, CVE-2026-24858 (CVSS 9.4), affecting FortiCloud SSO. Attackers successfully compromised systems already patched for related SSO issues, indicating an alternate attack path. Fortinet confirmed two malicious accounts exploited this flaw in the wild and has disabled FortiCloud SSO connections from vulnerable versions, with patches still in development for most affected products, as reported by Security Boulevard. <a href="https://app.daily.dev/posts/PBBlJiqf4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Google BigQuery integrates SQL-native AI inference</strong>: Google BigQuery now supports SQL-native managed inference, allowing data teams to deploy and run over 180,000 Hugging Face and Vertex AI models directly via SQL statements, eliminating the need for separate ML infrastructure. <a href="https://app.daily.dev/posts/eM9NtN7mD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust Foundation releases 2025 annual report and 2026-2028 strategic plan</strong>: The Rust Foundation released its 2025 Annual Report detailing financial support for the Rust Project and a 2026-2028 strategic plan focusing on stable infrastructure, maintainer support, and adoption growth. <a href="https://app.daily.dev/posts/DRpplNBlF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Quantum Development Kit updates</strong>: Microsoft announced major updates to its Quantum Development Kit (QDK), including integration with VS Code and GitHub Copilot, and new specialized toolkits for quantum chemistry and error correction. <a href="https://app.daily.dev/posts/0i847vEah" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Werf: a decade of Kubernetes software delivery tool evolution</strong>: Werf, an opinionated CLI tool for building container images and deploying to Kubernetes, has evolved into a CNCF Sandbox project used in 18,000 projects worldwide, integrating Git, Docker, Helm, and Kubernetes. <a href="https://app.daily.dev/posts/N7oGBGoq7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microservices pitfalls and modular monolith recommendation</strong>: A new article argues that microservices primarily address organizational problems and recommends starting with a well-structured modular monolith, using event storming to identify proper service boundaries. <a href="https://app.daily.dev/posts/aM21BxeGj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Don specification v1 for human-readable data serialization</strong>: DON (Directive Object Notation) v1 is a new human-readable data serialization format designed for configuration files and routing rules, using a directive-based model that allows repeated keys with different contexts. <a href="https://app.daily.dev/posts/g4MLpH6gr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>It is incorrect to “normalize” // in HTTP URL paths</strong>: RFC 3986 explicitly allows empty path segments in URLs, making double slashes (<code>//</code>) syntactically valid, and collapsing them to single slashes is an incorrect normalization that can break applications. <a href="https://app.daily.dev/posts/PuAnavg0v" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic CEO advocates minimal AI regulation amid profitability concerns</strong>: Anthropic CEO Dario Amodei penned a 22,000-word essay arguing for minimal AI regulation, focusing on theoretical superintelligent AI risks and advocating for restricting China’s chip access. Critics, however, suggest this is just typical corporate resistance, conveniently ignoring present concerns like wealth inequality and job displacement, especially since Anthropic isn’t expected to be profitable until 2028. Nothing like a good old-fashioned “think piece” to distract from the bottom line. <a href="https://app.daily.dev/posts/amOI7bITg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Enterprise AI agent rollouts face production challenges</strong>: Apparently, enterprise AI agent implementations are struggling to move from the lab to actual production, with only the biggest companies seeing success. Redis CEO noted fewer production AI agents than anticipated, citing challenges in aggregating unstructured data and replicating human judgment. It seems enterprises are hitting the “trough of disillusionment” regarding AI ROI, but hey, they’re still investing, because nothing says “next-gen infrastructure” like throwing money at something that isn’t quite working yet. <a href="https://app.daily.dev/posts/7PYYjzg77" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Moltbot AI assistant faces security and trademark challenges</strong>: Moltbot, the viral open-source AI assistant, is making waves, mostly by being a security nightmare. After being forced to change its name from Clawdbot due to Anthropic’s trademark concerns (because who needs originality when you have AI?), it’s now plagued by critical vulnerabilities like prompt injection and plaintext data storage. Its GitHub account was even hijacked by crypto scammers. So, if you’re looking for an AI assistant that’s popular, vulnerable, and a magnet for malware, Moltbot’s your guy! <a href="https://app.daily.dev/posts/zkO1JWwHu" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
