<h2>Must know</h2>
<ul>
<li><strong>WinRAR vulnerability actively exploited post-patch</strong>: A critical WinRAR vulnerability, CVE-2025-8088, remains actively exploited by various threat actors, including state-sponsored groups and financially motivated cybercriminals, despite a patch released in July 2025. This path traversal flaw allows attackers to hide malware using Windows Alternate Data Streams, facilitating the deployment of Remote Access Trojans (RATs). The widespread exploitation highlights the persistent danger of even patched vulnerabilities, as reported by multiple security outlets. <a href="https://app.daily.dev/posts/J0xyRLNez" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubernetes telemetry exploit allows full cluster compromise</strong>: A security researcher uncovered an exploit in Kubernetes’ <code>nodes/proxy GET</code> call that enables full cluster compromise and execution of privileged commands without leaving audit trails. Despite the severe implications, the Kubernetes team classified this as “intended behavior,” not a bug. A fix is planned for Kubernetes 1.36, but until then, administrators must audit RBAC policies and restrict <code>kubelet</code> port access to mitigate the risk, as detailed in the security researcher’s findings. <a href="https://app.daily.dev/posts/bOiz0Chx6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fortinet discloses critical SSO authentication bypass</strong>: Fortinet disclosed a new critical authentication bypass vulnerability, CVE-2026-24858, affecting FortiCloud SSO, with a CVSS score of 9.4. This flaw allowed attackers to compromise systems even after patches for related SSO issues were applied, indicating an alternate attack path. Fortinet confirmed two malicious accounts exploited this in the wild and has disabled FortiCloud SSO connections from vulnerable versions, with patches still in development for most affected products. <a href="https://app.daily.dev/posts/PBBlJiqf4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Rust Foundation releases 2025 annual report and strategic plan</strong>: The Rust Foundation released its 2025 Annual Report and a 2026-2028 strategic plan focusing on stable infrastructure, maintainer support, adoption growth, organizational engagement, and community building for the Rust Project. <a href="https://app.daily.dev/posts/DRpplNBlF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Klint Rust-based linting tool proposed for Linux kernel</strong>: RFC patches have been posted to integrate Klint, a Rust-based linting tool, into the Linux kernel to detect issues like incorrect prelude imports and excessive stack frame sizes, similar to Clippy. <a href="https://app.daily.dev/posts/RgFFWztiy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google launches Agentic Vision for Gemini 3 Flash</strong>: Google introduced Agentic Vision for Gemini 3 Flash, transforming static image processing into interactive investigation by combining visual reasoning with Python code execution for tasks like image annotation and table parsing. <a href="https://app.daily.dev/posts/KIgS0LnaZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google releases TranslateGemma open-source translation models</strong>: Google released TranslateGemma, an open-source translation model suite built on Gemma 3 architecture, offering 4B, 12B, and 27B parameter variants supporting 55 languages with multimodal capabilities. <a href="https://app.daily.dev/posts/Fvt1eqDgo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google BigQuery integrates SQL-native AI inference</strong>: Google BigQuery now supports SQL-native managed inference, allowing data teams to deploy and run over 180,000 Hugging Face and Vertex AI models directly via SQL statements, eliminating separate ML infrastructure management. <a href="https://app.daily.dev/posts/eM9NtN7mD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SERA open-source coding agent announced</strong>: SERA, an open-source coding agent, achieves state-of-the-art performance on SWE-Bench Verified at 54.2% and is affordable to train and customize, running efficiently on NVIDIA hardware. <a href="https://app.daily.dev/posts/y5jjtMeVw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox and Windows 11 release updates</strong>: Firefox 147 shipped with major web platform features like Navigation API and CSS Anchor Positioning, while Windows 11 Insider Preview Build 26300.7674 includes fixes for File Explorer and Start menu issues. <a href="https://app.daily.dev/feed-by-ids?id=MHu1Kt5o3&amp;id=P4NFiRPo5&amp;id=YpmFb9dA2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic CEO argues for minimal AI regulation, conveniently ignoring current problems</strong>: Anthropic CEO Dario Amodei, whose company isn’t expected to be profitable until 2028, penned a 22,000-word essay arguing for minimal AI regulation, focusing on theoretical superintelligent AI risks while conveniently sidestepping present concerns like wealth inequality and rising utility costs from datacenter construction. It’s almost as if the ‘existential threat’ narrative is more palatable than discussing the immediate, tangible impacts of their rapidly advancing, yet financially struggling, technology, as noted by critics. <a href="https://app.daily.dev/posts/amOI7bITg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Enterprise AI agents: still stuck in the lab, but don’t tell the VCs</strong>: Apparently, enterprise AI agent implementations are struggling to make it out of the lab and into actual production, with the Redis CEO reporting fewer deployed agents than anticipated. The problem? Aggregating unstructured data and replicating human judgment, which, you know, are kind of essential for ‘intelligence.’ But don’t worry, major companies are still pouring money into these platforms, because nothing says ‘next-generation infrastructure’ like a ‘trough of disillusionment’ and a lack of ROI, as reported by industry observers. <a href="https://app.daily.dev/posts/7PYYjzg77" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Moltbot AI assistant: a security nightmare wrapped in viral hype</strong>: Moltbot, the open-source personal AI assistant, has gone viral with over 44,000 GitHub stars, despite being a security researcher’s worst nightmare. It operates locally, uses Cloudflare, and autonomously manages tasks across messaging apps, but comes with critical vulnerabilities like prompt injection, plaintext data storage, and a hijacked GitHub account. So, if you’re looking for a quick way to get your sensitive data stolen by malware families like Vidar, Lumma, and RedLine, Moltbot’s your guy, as widely reported across tech news. <a href="https://app.daily.dev/posts/zkO1JWwHu" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
