<h2>Must know</h2>
<ul>
<li><strong>Kubernetes RCE flaw identified, fix delayed</strong>: Edera Advisory discovered a critical design flaw in Kubernetes that allows remote code execution (RCE) in any container on a node via commonly used <code>nodes/proxy GET</code> permissions. While a fix is slated for Kubernetes 1.36, expected in April 2025, many production clusters won’t update for months or years, leaving them vulnerable. Organizations need to scan for RCE attempts and implement fine-grained authorization controls, as detailed in the advisory. <a href="https://app.daily.dev/posts/phMyeDnVg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Apple acquires audio AI startup <a href="http://Q.ai" target="_blank" rel="noopener nofollow">Q.ai</a></strong>: Apple acquired Israeli audio AI startup <a href="http://Q.ai" target="_blank" rel="noopener nofollow">Q.ai</a> for an estimated $1.6 billion to nearly $2 billion, integrating its machine learning expertise in whispered speech recognition and audio enhancement. This move strengthens Apple’s AI hardware capabilities, particularly for AirPods and Vision Pro, and aligns with its broader AI initiatives, as reported by various tech outlets. <a href="http://Q.ai" target="_blank" rel="noopener nofollow">Q.ai</a>’s 100 employees will join Apple, marking a significant push in audio AI. <a href="https://app.daily.dev/posts/PknWg8Xks" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Container security practices show significant gaps</strong>: A BellSoft survey revealed that nearly a quarter of developers experienced container-related security incidents last year, with human error being the primary cause for 62% of mistakes. Despite this, 86% of organizations prioritize performance over security when selecting base images, and only 43% use vulnerability scanning tools. This highlights a critical disconnect and a reliance on general-purpose images that require more security work, according to the survey. <a href="https://app.daily.dev/posts/I55IVTrKU" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Musk companies explore major mergers</strong>: SpaceX, xAI, and potentially Tesla are in early merger discussions to form a trillion-dollar super-company, aiming to combine rockets, satellites, AI, and electric vehicles, with a key rationale being space-based AI data centers. <a href="https://app.daily.dev/posts/wMYF638eZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Meta escalates AI infrastructure investment</strong>: Meta plans to invest $115-135 billion in AI infrastructure in 2026, nearly doubling its 2025 investment, to support Superintelligence Labs and integrate large language models across its platforms. <a href="https://app.daily.dev/posts/JHGPGk0MW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft deploys in-house AI chip while still buying from Nvidia</strong>: Microsoft has deployed its Maia 200 AI inference chip in data centers for frontier AI models and OpenAI, but CEO Satya Nadella confirmed they will continue purchasing chips from Nvidia and AMD, indicating a diversified supply chain strategy. <a href="https://app.daily.dev/posts/kN85HgrLU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Certificate pinning alone won’t stop modern MITM attacks</strong>: Certificate pinning protects against network-level TLS interception but is insufficient against modern threats like runtime hooking and token theft, requiring a defense-in-depth approach with strong TLS, short-lived tokens, and device integrity signals. <a href="https://app.daily.dev/posts/lY2Ys6iwc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Let’s Encrypt offers six-day certificates</strong>: Let’s Encrypt now provides six-day certificates and IP address certificates, reducing the window for attackers but requiring more frequent, automated renewals, which can be challenging for operational teams. <a href="https://app.daily.dev/posts/O9BTVUIDz" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>G_Wagon infostealer found in npm package</strong>: A malicious npm package, <code>ansi-universal-ui</code>, deploys the G_Wagon infostealer to steal crypto wallets, cloud credentials, and SSH keys, leveraging Appwrite for command and control, with all versions affected and a CVSS score of 9.3. <a href="https://app.daily.dev/posts/2hgomnT3H" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Numana expands quantum-safe test bed</strong>: Numana expanded its Kirq quantum-safe test bed to Québec City, creating a connected testing loop across three Canadian cities to allow organizations to test quantum-secure communications systems on live networks. <a href="https://app.daily.dev/posts/aIbGJwtKG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Google DeepMind’s Project Genie: infinite worlds, finite fun</strong>: Google DeepMind launched Project Genie, an ‘experimental web prototype’ that generates ‘infinite, interactive environments’ using the Genie 3 world model. Apparently, this is a ‘step toward AGI’ and a ‘tool for game prototyping,’ according to Google. Never mind the 60-second generation caps, physics inconsistencies, and character control issues; it’s all about the ‘whimsical, artistic styles’ like claymation, because photorealism and object interaction are clearly overrated. Oh, and 52% of game developers now think AI negatively impacts their field, up from 30% last year, probably because they’re too busy getting laid off to appreciate the ‘infinite’ possibilities. <a href="https://app.daily.dev/posts/iit38VC43" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Meta Reality Labs: still losing billions, but now with more ‘strategic pivots’</strong>: Meta’s Reality Labs managed to lose another $19.2 billion in FY25, bringing its total losses to a cool $83.6 billion since 2020. But don’t worry, CEO Mark Zuckerberg assures us this is ‘peak losses’ and they’re making a ‘strategic shift’ towards glasses and wearables, because clearly, throwing more money at a problem that hasn’t worked for years is the answer. They even closed three VR studios and cut 10% of staff, which is just good business when you’re pivoting to ‘AI-integrated wearables’ that nobody asked for. <a href="https://app.daily.dev/posts/ALCffHVkc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents: the new security nightmare you didn’t ask for</strong>: Apiiro launched Guardian Agent, an AI security tool that ‘rewrites developer prompts into secure ones in real-time’ because, apparently, AI coding agents are generating 4x more code and expanding attack surfaces 6x. So, we’ve created a problem with AI, and now we need more AI to fix the problem created by AI. It’s a perfect loop of ‘innovation’ where developers are ‘often unaware of vulnerabilities in AI-generated code.’ What could possibly go wrong? <a href="https://app.daily.dev/posts/5AaMXyHJd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
