<h2>Must know</h2>
<ul>
<li><strong>Kubernetes exploit allows full cluster compromise</strong>: A security researcher uncovered an exploit in Kubernetes’ <code>nodes/proxy GET</code> call that enables full cluster compromise and privileged command execution without leaving audit trails. Despite the severe impact, the Kubernetes team labeled this as “intended behavior,” not a bug, and no CVE was issued. A fix, KEP-2862, is planned for Kubernetes 1.36, but until then, administrators should audit RBAC policies and restrict <code>kubelet</code> port access to mitigate the risk, as reported by various security outlets. <a href="https://app.daily.dev/posts/bOiz0Chx6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WinRAR vulnerability actively exploited post-patch</strong>: A critical WinRAR vulnerability, CVE-2025-8088, remains actively exploited by various threat actors, including state-sponsored groups and financially motivated cybercriminals, even after a patch was released in July 2025. This path traversal flaw allows attackers to hide malware using Windows Alternate Data Streams, facilitating the deployment of Remote Access Trojans (RATs). Targets range from Ukrainian military entities to Brazilian banking users, highlighting the persistent danger of this flaw. <a href="https://app.daily.dev/posts/J0xyRLNez" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-powered polymorphic phishing bypasses traditional security</strong>: A new polymorphic phishing attack leverages AI models like DeepSeek and Gemini to dynamically generate malicious JavaScript code directly within victims’ browsers. This technique, termed “last mile reassembly,” splits malware into fragments delivered via separate AI prompts, reassembling client-side from trusted LLM domains. This method effectively bypasses traditional security measures that rely on static payload analysis, marking a significant advancement in offensive AI capabilities. <a href="https://app.daily.dev/posts/jfmiKNwaJ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Rust Foundation releases strategic plan</strong>: The Rust Foundation published its 2025 Annual Report and a 2026-2028 strategic plan focusing on stable infrastructure, maintainer support, adoption growth, organizational engagement, and community building for the Rust Project. <a href="https://app.daily.dev/posts/DRpplNBlF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft updates Quantum Development Kit</strong>: Microsoft announced significant updates to its Quantum Development Kit (QDK), including integration with VS Code and GitHub Copilot for AI-assisted quantum programming, and new specialized toolkits for quantum chemistry and error correction. <a href="https://app.daily.dev/posts/0i847vEah" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google BigQuery integrates SQL-native AI inference</strong>: Google BigQuery now supports SQL-native managed inference, allowing data teams to deploy and run over 180,000 Hugging Face and Vertex AI models directly via SQL statements, eliminating the need for separate ML infrastructure. <a href="https://app.daily.dev/posts/eM9NtN7mD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NVIDIA pushes for quantum initiative renewal</strong>: NVIDIA is advocating for the reauthorization of the National Quantum Initiative, emphasizing the need to integrate quantum computing with AI and high-performance computing to maintain U.S. leadership in the field. <a href="https://app.daily.dev/posts/POHVAcusS" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fortinet discloses critical SSO authentication bypass</strong>: Fortinet revealed a new critical authentication bypass vulnerability, CVE-2026-24858, affecting FortiCloud SSO, which has already been exploited in the wild despite previous patches for related issues. <a href="https://app.daily.dev/posts/PBBlJiqf4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust-based linting tool proposed for Linux kernel</strong>: RFC patches have been submitted to integrate Klint, a Rust-based linting tool, into the Linux kernel to detect issues like incorrect prelude imports and excessive stack frame sizes. <a href="https://app.daily.dev/posts/RgFFWztiy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quarkus 3.31 released with Java 25 support</strong>: Quarkus 3.31 is out, bringing full support for Java 25, a new Maven packaging type for faster builds, Panache Next for improved developer experience, and upgrades to Hibernate ORM and Reactive. <a href="https://app.daily.dev/posts/aOZ3V2uL4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic CEO argues for minimal AI regulation (surprise!)</strong>: Anthropic CEO Dario Amodei penned a 22,000-word essay arguing for minimal AI regulation, focusing on theoretical superintelligent AI risks and, conveniently, restricting China’s chip access. Critics, however, point out that this ‘thought leadership’ conveniently ignores present-day issues like wealth inequality and rising utility costs from datacenter construction. It’s almost as if a company not expected to be profitable until 2028 might have a vested interest in less oversight. <a href="https://app.daily.dev/posts/amOI7bITg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Moltbot: the viral AI assistant that’s also a security nightmare</strong>: Moltbot, the open-source personal AI assistant, has gone viral with over 44,000 GitHub stars, despite security experts warning of critical vulnerabilities like prompt injection and plaintext data storage. Its GitHub account was even hijacked by crypto scammers. So, while everyone’s ‘screaming about’ this tool, maybe we should also be screaming about the fact that it’s a giant, unpatched security hole waiting to happen, especially when it’s autonomously managing your calendar and messaging. <a href="https://app.daily.dev/posts/zkO1JWwHu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Enterprise AI agents: still stuck in the lab, apparently</strong>: Turns out, those enterprise AI agents we’ve been hearing so much about are struggling to make it from the lab to actual production. The Redis CEO noted fewer production AI agents than anticipated, citing challenges in aggregating unstructured data and replicating human judgment. It seems the ‘trough of disillusionment’ for AI ROI is deepening, even as major companies keep throwing money at these ‘next-gen infrastructure’ platforms. Who could’ve seen that coming? <a href="https://app.daily.dev/posts/7PYYjzg77" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
