<h2>Must know</h2>
<ul>
<li><strong>Figma and Canva push AI-powered design, Microsoft expands VR and AI in Windows</strong>: Figma announced dynamic design systems with direct npm code component imports and AI-powered linting, aiming to close the design-to-code gap. Canva, now a ‘Creative Operating System,’ integrates AI for marketing and creative tasks, while also offering premium users AI features within Affinity. Meanwhile, Microsoft launched Mixed Reality Link for Windows 11 on Meta Quest headsets, streaming desktops into VR, and refreshed Microsoft 365 icons to emphasize AI as ‘connective tissue,’ according to company statements. These moves highlight a strong industry push towards AI-driven design, development, and user experiences across platforms.</li>
<li><strong>AI agents are everywhere, but security and governance are lagging</strong>: Enterprises are rapidly adopting agentic AI, with 68% planning investments within two years, according to survey data. Companies like Mercari are standardizing AI coding assistant configurations, and Aembit is introducing IAM for agentic AI to address secure access. However, experts like Shuai Guo warn that current infrastructure and assurance layers haven’t kept pace, emphasizing the need for robust guardrails and systems thinking to prevent information contamination and security lapses. The Model Context Protocol (MCP) is emerging as a standard for AI-to-system integration, but it also expands attack surfaces, introducing new machine-to-machine communication risks, as highlighted by Contrast Security and CISO guides.</li>
<li><strong>Major cloud outages highlight fragility, open source security under attack</strong>: AWS, Google Cloud, and Microsoft Azure all experienced significant outages, with incidents ranging from DNS race conditions to configuration errors, affecting critical services globally, as reported by technical deep dives and incident coverage. These events underscore the fragility of hyperscale infrastructure and the challenges of multiregion incident response. Simultaneously, open-source security is under escalating threat, with tools like AdaptixC2 being weaponized by cybercriminals and new techniques emerging, such as malware embedded in Windows’ AI stack via ONNX files, according to Silent Push researchers and hxr1.</li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Google and Meta solidify market dominance with AI</strong>: Alphabet and Meta both reported record-breaking quarters, attributing significant revenue growth to AI-enhanced products and infrastructure investments, with Meta pushing AI-generated content into user feeds and testing standalone AI social apps.</li>
<li><strong>AI-powered coding accelerates Java development, but security concerns rise</strong>: Adam Bien demonstrated 10x faster Java development using AI coding assistants like Claude Code and Kiro, while Foojay’s newsletter highlighted rising security vulnerabilities in the Model Context Protocol (MCP) ecosystem and new attack vectors in AI-powered IDEs.</li>
<li><strong>Samsung pushes AI in browsers and chips, challenging Google and Qualcomm</strong>: Samsung launched a beta of its Internet browser for Windows PCs with AI-powered summarization and translation, directly competing with Google, and plans to bolster its Exynos processors with improved NPUs, reducing reliance on Qualcomm.</li>
<li><strong>New efficient MoE language models from IBM and Ant Group</strong>: IBM released Granite 4.0, a hybrid Transformer and Mamba 2 architecture model claiming 80% lower memory consumption, while Ant Group’s Ling 2.0 focuses on reasoning with up to 1T parameters, both leveraging Mixture-of-Experts (MoE) for efficiency.</li>
<li><strong>Qt Creator 18 adds dev containers and workflow enhancements</strong>: Qt Creator 18 introduces experimental support for development containers using devcontainer.json, updates C++ tooling with Clangd/LLVM 21.1, and enhances UI with a redesigned Welcome mode and improved Git commit editor actions.</li>
<li><strong>Kotlin 2.2.20 and 2.2.21 advance WebAssembly and Swift interoperability</strong>: Kotlin’s latest releases bring WebAssembly support to beta with browser debugging, introduce experimental Swift export for mobile developers, and add data flow-based exhaustiveness checks for improved code safety.</li>
<li><strong>Tailscale launches identity federation and app capabilities</strong>: Tailscale released workload identity federation for secure CI/CD authentication via OIDC tokens and introduced app capabilities using HTTP headers for granular, identity-aware access control within applications.</li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AGI hype: the new religion for Silicon Valley’s bank accounts</strong>: Apparently, AGI, which still lacks a standardized definition and any evidence of feasibility, is now the central narrative for the AI industry. This ‘unfalsifiable’ belief, pushed by high-profile proponents and investors, conveniently justifies massive fundraising and policy lobbying. It’s almost as if promising either salvation or catastrophe, regardless of actual science, is a great way to keep the money flowing and distract from practical AI uses. Who needs real progress when you have faith?</li>
<li><strong>AI-driven fraud: because the old ways weren’t scammy enough</strong>: While ransomware profits are supposedly decreasing due to better defenses, AI is now enabling low-skill actors to create deepfakes and run automated scams, with projected U.S. fraud losses reaching $40 billion by 2027. Google claims its on-device AI blocks billions of scam messages, but scammers are just shifting tactics to group chats and cross-country operations. So, we’re in an AI arms race where the bad guys get smarter, and regulations lag, leaving us all to wonder if our ‘enhanced defenses’ are just playing whack-a-mole with a super-powered mallet.</li>
<li><strong>Breach and attack simulation: the new ‘evidence-based’ security buzzword</strong>: Breach and Attack Simulation (BAS) is apparently moving security ‘beyond compliance’ to ‘evidence-based practice’ by emulating real adversarial behaviors in live environments. With AI integration, it promises to automate threat intelligence into actionable attack emulations in hours. This sounds great, but the article is suspiciously devoid of specific vendors, actual incidents, or any quantifiable data to back up these claims. It’s almost as if ‘evidence-based’ means ‘trust us, it’s better now,’ without showing any actual evidence.</li>
</ul>
