<h2>Must know</h2>
<ul>
<li><strong>Axios npm package hijacked to deploy cross platform RAT</strong>: The popular Axios HTTP client, with over 300 million weekly downloads, suffered a major supply chain attack on March 31, 2026. Attackers hijacked a lead maintainer’s credentials to publish versions 1.14.1 and 0.30.4, which inject a hidden dependency that executes a Remote Access Trojan on macOS, Windows, and Linux. Socket and Vercel reported that the malware self-deletes to evade forensics, so anyone who ran an install during the three-hour window should assume full system compromise and rotate all secrets immediately. <a href="https://app.daily.dev/feed-by-ids?id=RlEVDfzaA&amp;id=6mR1VFvvx&amp;id=Cs5sU7Y7b" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic accidentally leaks Claude Code source code via npm</strong>: On April 1, 2026, Anthropic mistakenly included full source maps in a Claude Code npm release, exposing approximately 500,000 lines of proprietary TypeScript. The leak, attributed to a known Bun development server bug, revealed unreleased features like ‘dream mode’ for background memory consolidation and an ‘undercover’ mode that hides AI authorship in commits. Security researchers are already using the snapshot to analyze internal tool systems and anti-distillation mechanisms. <a href="https://app.daily.dev/feed-by-ids?id=7folff4vx&amp;id=ZCefS7s98&amp;id=cLSmwFJgK&amp;id=d39v889GW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical RCE in Langflow framework exploited in the wild</strong>: CISA has added a critical code injection vulnerability in Langflow (CVE-2026-33017) to its Known Exploited Vulnerabilities catalog just hours after disclosure. The flaw allows unauthenticated attackers to execute arbitrary Python code via an unprotected API endpoint, potentially exfiltrating API keys for OpenAI and AWS. Users of the open-source AI agent framework must upgrade to version 1.9.0 immediately to mitigate active exploitation. <a href="https://app.daily.dev/feed-by-ids?id=3mcV26SDC&amp;id=qG8of5vvO" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Wine 11 introduces NTSYNC for massive Linux gaming gains</strong>: A kernel-level thread synchronization rewrite delivers significant performance improvements for Windows games running on Linux. <a href="https://app.daily.dev/posts/pNy5xKg0N" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kyverno graduates from CNCF as policy as code matures</strong>: The Kubernetes-native policy engine reached the highest maturity level and now fully adopts Common Expression Language for enforcement. <a href="https://app.daily.dev/feed-by-ids?id=2t2tcYM88&amp;id=leqEkFz9G" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Safari 26.4 ships masonry layouts and WebTransport</strong>: The latest WebKit release adds CSS Grid Lanes for native masonry and low-latency bidirectional communication over HTTP/3. <a href="https://app.daily.dev/posts/vXvtsrMcB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>IntelliJ IDEA 2026.1 adds Java 26 and multi-agent support</strong>: The update includes structured concurrency for Java 26 and allows bringing your own keys for Anthropic and OpenAI models. <a href="https://app.daily.dev/posts/KcQd7FpkV" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AMD revives hardware accelerated vIOMMU patches</strong>: A new 22-patch series aims to reduce CPU overhead for guest IOMMUs by enabling partial hardware acceleration. <a href="https://app.daily.dev/posts/vZE44shTF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Inertia.js v3.0 drops Axios for a built-in XHR client</strong>: The major release features optimistic updates, Svelte 5 support, and removes 15KB from client bundles. <a href="https://app.daily.dev/posts/WWmxp0DEw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PHPantom is a new Rust based LSP for PHP</strong>: This lightweight language server starts in under a second and uses only 59MB of RAM while providing deep type intelligence. <a href="https://app.daily.dev/posts/lreBnQIWD" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The AI ROI crisis meets tokenmaxxing leaderboards</strong>: While only 31% of UK firms report positive AI returns, engineers at big tech firms are literally competing on ‘tokenmaxxing’ leaderboards to see who can burn the most compute. It’s a classic case of Goodhart’s Law where we’ve started measuring the appearance of productivity instead of actual output. If your primary engineering metric is how many millions of tokens you can feed a model to do your job, you aren’t an engineer; you’re a glorified prompt-shoveler. <a href="https://app.daily.dev/feed-by-ids?id=dl9dAiLtW&amp;id=pC2UbmMBj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI security tools are the new blinky light boxes</strong>: ThreatLocker and other industry veterans are calling out the ‘fight AI with AI’ narrative as pure marketing garbage that ignores foundational security. Most ‘AI-powered’ security tools are just wrappers for basic pattern matching that fail to determine actual software intent. We’re being sold expensive, non-deterministic black boxes to solve problems that could be fixed by simply blocking untrusted binaries and closing open ports. <a href="https://app.daily.dev/feed-by-ids?id=f6diiN9F1&amp;id=hGISe6eqU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding is just technical debt with a better UI</strong>: The industry is currently obsessed with ‘vibe coding’—letting AI agents generate entire apps from vague prompts without the developer understanding a single line of the output. Security research shows only 10% of this output is production-ready, yet it’s being shipped at scale, creating a massive ‘review tax’ for senior engineers. We’re essentially using trillion-parameter models to automate the creation of legacy codebases that will be unmaintainable by next Tuesday. <a href="https://app.daily.dev/feed-by-ids?id=Wjx2MWbPj&amp;id=zIHU4vVQv&amp;id=xsXQhvmqn" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
