<h2>Must know</h2>
<ul>
<li><strong>Kubernetes telemetry exploit allows full cluster compromise</strong>: A security researcher uncovered an exploit in Kubernetes’ <code>nodes/proxy GET</code> call that enables privileged command execution and full cluster compromise without leaving audit trails. Despite the severe implications, the Kubernetes team labeled this as “intended behavior,” not a bug, and thus no CVE was issued. A fix, KEP-2862, is slated for Kubernetes 1.36, but until then, administrators should audit RBAC policies and restrict <code>kubelet</code> port access to mitigate the risk, as reported by multiple security outlets. <a href="https://app.daily.dev/posts/bOiz0Chx6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WinRAR vulnerability actively exploited post-patch</strong>: A critical WinRAR vulnerability, CVE-2025-8088, remains actively exploited by various threat actors, including state-sponsored groups and cybercriminals, despite a patch released in July 2025. This path traversal flaw allows attackers to hide malware using Windows Alternate Data Streams, facilitating the deployment of Remote Access Trojans (RATs). The exploit, initially sold for $80,000 on cybercrime forums, continues to target military, government, and commercial entities globally, according to security researchers. <a href="https://app.daily.dev/posts/J0xyRLNez" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fortinet discloses critical SSO authentication bypass</strong>: Fortinet revealed a new critical authentication bypass vulnerability, CVE-2026-24858 (CVSS 9.4), affecting FortiCloud SSO. This flaw allowed attackers to compromise systems even after previous SSO patches, indicating an alternate attack path. Fortinet confirmed two malicious accounts exploited this in the wild and has disabled FortiCloud SSO connections from vulnerable versions as a temporary mitigation. Patches for most affected products, including FortiAnalyzer and FortiManager, are still in development. <a href="https://app.daily.dev/posts/PBBlJiqf4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Google BigQuery integrates SQL-native AI inference</strong>: Google BigQuery now supports SQL-native managed inference, allowing data teams to deploy and run over 180,000 Hugging Face and Vertex AI models directly via SQL statements, eliminating the need for separate ML infrastructure. <a href="https://app.daily.dev/posts/eM9NtN7mD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google launches agentic vision for Gemini 3 Flash</strong>: Google introduced Agentic Vision for Gemini 3 Flash, transforming static image processing into interactive investigation by combining visual reasoning with code execution, enabling AI agents to zoom, inspect, and manipulate images step-by-step. <a href="https://app.daily.dev/posts/KIgS0LnaZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SERA open-source coding agent announced</strong>: SERA, an open-source coding agent, achieves state-of-the-art performance on SWE-Bench Verified at 54.2% and is affordable to train, costing approximately $400 for reproduction, matching or exceeding 100B+ parameter models. <a href="https://app.daily.dev/posts/y5jjtMeVw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Dynatrace launches AI observability app and agentic operations platform</strong>: Dynatrace released its AI Observability app and a new agentic operations platform, providing end-to-end visibility for agent interactions, tool usage, and errors across major cloud providers, aiming to shift to autonomous operations. <a href="https://app.daily.dev/posts/d1KKTrRCA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google releases TranslateGemma open-source translation models</strong>: Google launched TranslateGemma, an open-source translation model suite built on the Gemma 3 architecture, offering 4B, 12B, and 27B parameter variants supporting 55 languages with multimodal capabilities. <a href="https://app.daily.dev/posts/Fvt1eqDgo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust Foundation releases 2025 annual report and strategic plan</strong>: The Rust Foundation published its 2025 Annual Report and a 2026-2028 strategic plan focusing on stable infrastructure, maintainer support, adoption growth, organizational engagement, and building global communities for the Rust Project. <a href="https://app.daily.dev/posts/DRpplNBlF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>France adopts homegrown Visio for digital sovereignty</strong>: France is replacing U.S. video conferencing platforms with its homegrown Visio across all public services by 2027 to ensure government data remains under French jurisdiction and avoid foreign laws like the U.S. CLOUD Act. <a href="https://app.daily.dev/posts/32Qx0g0Ch" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic CEO advocates minimal AI regulation amid profitability concerns</strong>: Anthropic CEO Dario Amodei penned a 22,000-word essay arguing for minimal AI regulation, primarily focusing on theoretical superintelligent AI risks and advocating for restricting China’s chip access. Critics, however, suggest this is a thinly veiled attempt to resist regulation, especially given Anthropic isn’t expected to be profitable until 2028 and AI model advancement might be slowing. It’s almost as if corporate self-interest trumps societal well-being, who would’ve thought? <a href="https://app.daily.dev/posts/amOI7bITg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Enterprise AI agent rollouts face production challenges</strong>: Apparently, enterprise AI agent implementations are struggling to move from the lab to actual production, with only the largest companies seeing success. The Redis CEO noted fewer production AI agents than anticipated, citing challenges in aggregating unstructured data and replicating human judgment. It seems the ‘trough of disillusionment’ for AI ROI is hitting hard, but don’t worry, major companies are still throwing money at these platforms, because ‘next-generation infrastructure’ sounds so much better than ‘expensive science project.’ <a href="https://app.daily.dev/posts/7PYYjzg77" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Moltbot AI assistant faces security and trademark challenges</strong>: Moltbot, the viral open-source AI assistant, is making headlines for all the wrong reasons. First, Anthropic forced a name change from Clawdbot due to trademark concerns—because apparently, an open-source project can’t be ‘inspired’ by Claude. Now, security experts are screaming about critical vulnerabilities like prompt injection and plaintext data storage, while its GitHub was hijacked by crypto scammers. It’s a perfect storm of hype, insecurity, and corporate overreach, proving that ‘viral’ often means ‘wildly irresponsible.’ <a href="https://app.daily.dev/posts/zkO1JWwHu" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
