<h2>Must know</h2>
<ul>
<li><strong>AI-powered ransomware is here, and it’s getting smarter</strong>: ESET reports the first ransomware using AI, specifically GPT models via Ollama API, to generate dynamic code and ransom notes. This Go-based malware aims to evade signature detection, signaling an escalation in attack sophistication. Anthropic also confirmed threat actors are abusing Claude AI for reconnaissance and building ransomware, highlighting AI’s dual role as both an attack enabler and a defensive aid. Meanwhile, a new group, Yurei, is rapidly weaponizing open-source ransomware, demonstrating the ease of global proliferation for such threats.</li>
<li><strong>CISA tightens grip on CVE and SBOM standards</strong>: CISA is pushing for government-led oversight of the CVE program, citing national security, which creates tension with the CVE Foundation’s preference for vendor-neutral management. Simultaneously, CISA released a draft revision of its SBOM guidance, adding four new data fields like component hash and license info. This move, influenced by international regulations like the EU Cyber Resilience Act, aims to improve software identification and compliance, but the community remains divided on governance.</li>
<li><strong>Critical vulnerabilities exploited in industrial and enterprise software</strong>: CISA has flagged a deserialization vulnerability (CVE-2025-5086) in DELMIA Apriso manufacturing software as actively exploited, allowing remote code execution. Federal agencies are mandated to patch by October 2, 2025. Cyble reports 1,224 vulnerabilities in the recent Patch Tuesday, with 129 having working proof-of-concept exploits, including critical flaws in SAP NetWeaver and Adobe Commerce. This indicates a systemic risk across both enterprise IT and industrial infrastructure.</li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>OpenTelemetry expands for AI agents and gets Google Cloud support</strong>: OpenTelemetry is extending its semantic capabilities to include observability for AI agents, allowing unified monitoring of both legacy and AI systems, with Google Cloud Observability’s Cloud Trace now natively supporting OpenTelemetry Protocol (OTLP).</li>
<li><strong>Microsoft unbundles Teams in Europe to avoid EU fines</strong>: Microsoft will unbundle Teams from Office/Microsoft 365 in Europe, offering Office without Teams at a reduced price, following a five-year antitrust investigation triggered by Slack’s complaint.</li>
<li><strong>NPM supply chain attack impacts billions of downloads</strong>: A major supply chain attack compromised 18 popular NPM packages, affecting over 2 billion weekly downloads, after a maintainer was phished, leading to malicious code injecting cryptocurrency-draining capabilities.</li>
<li><strong>Non-human identities and token mismanagement pose supply chain risks</strong>: OAuth tokens in third-party integrations are a major supply chain security risk, with recent breaches exploiting compromised tokens, and non-human identities now outnumbering human users by 45:1, leading to widespread ‘secrets sprawl’.</li>
<li><strong>Vercel launches AI Gateway with new chat model support</strong>: Vercel has launched its AI Gateway for production, offering a unified API endpoint for multiple AI models, including Meituan’s new LongCat-Flash Chat, notable for agentic tool use and dynamic parameter activation.</li>
<li><strong>Kubernetes maintainer burnout causes security disaster</strong>: The Kubernetes External Secrets Operator (ESO), a critical tool for managing secrets, has effectively shut down due to maintainer burnout, freezing development until at least five new maintainers can be recruited.</li>
<li><strong>Rust continues its rise in systems development</strong>: Rust is recognized as the most admired programming language for nine consecutive years, with major tech companies like Microsoft, Google, and AWS adopting it for critical infrastructure projects due to its performance and memory safety.</li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI productivity paradox: faster typing, slower work</strong>: Cerbos research suggests AI coding assistants create a ‘productivity paradox,’ where developers feel faster but actually work slower, with experienced developers being 19% slower. Apparently, streamlining boilerplate code and rapid MVP development isn’t quite the 10x productivity miracle promised, and it introduces a 322% rise in privilege escalation paths. Who knew that typing speed wasn’t the bottleneck in software development?</li>
<li><strong>AI consciousness is an illusion, but energy demands are very real</strong>: Microsoft’s AI chief Mustafa Suleyman says machine consciousness is ‘an illusion,’ which is great, because we definitely don’t need sentient robots. What we do need, apparently, is more natural gas, as U.S. Interior Secretary Doug Burgum suggests prevailing in the AI tech race outweighs climate priorities. So, while AI isn’t conscious, it’s certainly consuming enough energy to make us question our own consciousness when the bills arrive.</li>
<li><strong>AI agents fail to make it to production, but don’t worry, we have a solution!</strong>: Databricks reports that most generative AI agents fail to reach production due to a lack of robust, domain-specific evaluation frameworks. But fear not, Cypress has cy.prompt(), an embedded AI-driven natural language test-writing tool that promises reliability and maintainability. It seems the solution to AI’s production woes is… more AI, but this time, it’s ‘tightly integrated’ and ‘self-healing,’ because that always works out perfectly.</li>
</ul>
