<h2>Must know</h2>
<ul>
<li><strong>Axios npm package hijacked in sophisticated supply chain attack</strong>: The lead maintainer’s npm account was compromised on March 31, 2026, leading to the publication of malicious versions <code>axios@1.14.1</code> and <code>axios@0.30.4</code>. These versions injected a fake dependency, <code>plain-crypto-js</code>, which deployed a cross-platform Remote Access Trojan (RAT) designed to steal credentials and self-delete. Socket and StepSecurity report this as one of the most operationally sophisticated attacks against a top-10 package, bypassing standard CI/CD workflows via manual CLI pushes. <a href="https://app.daily.dev/feed-by-ids?id=RlEVDfzaA&amp;id=VsVIeSTu2&amp;id=yQuwbHYRC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google sets 2029 deadline for post quantum migration</strong>: Google has announced a firm 2029 deadline to complete its transition to post-quantum cryptography (PQC) across all products and services. Android 17 will lead the charge by implementing NIST-standardized algorithms like ML-DSA for verified boot and native Keystore support to combat ‘harvest now, decrypt later’ threats. Security experts warn that a 2,048-bit RSA integer could theoretically be factored in under a week using one million noisy qubits, making immediate cryptographic inventories a priority. <a href="https://app.daily.dev/posts/2Ya2QAFm3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OS level age verification laws trigger industry resistance</strong>: Privacy-focused Android fork GrapheneOS has publicly stated it will exit regions that enforce emerging OS-level age verification mandates, prioritizing its no-personal-information setup policy. While systemd has already merged code to record user age, vendors like System76 are pushing back against proposed regulations in Colorado and California. The debate frames these checks as a choice between child protection and a slippery slope toward broader state surveillance. <a href="https://app.daily.dev/feed-by-ids?id=agWvIPypH&amp;id=etL2H8W4G" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>rvLLM brings high performance Rust inference to vLLM</strong>: A from-scratch Rust rewrite of vLLM achieves ~3,467 tok/s on A100s with a 16MB binary and 6-second cold starts. <a href="https://app.daily.dev/posts/u7fISleFK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Turbolite serves SQLite queries directly from S3</strong>: This Rust-based VFS enables sub-250ms cold latency for SQLite on object storage using B-tree-aware page grouping. <a href="https://app.daily.dev/posts/9ZseH6udT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Prism Workers AI bridges Laravel to Cloudflare</strong>: A new PHP package adds Cloudflare Workers AI as a provider for Prism, supporting multi-step tool calling and reasoning models. <a href="https://app.daily.dev/posts/vbnbCooLn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TutorialKit.rb runs interactive Ruby in the browser</strong>: Now in release candidate, this tool uses WebAssembly and WebContainers to execute full Rails tutorials entirely client-side. <a href="https://app.daily.dev/posts/5gQhfNWeF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Lima v2.1 adds macOS guest support and agent sandboxing</strong>: The update allows AI agents to run against isolated VM copies of files with interactive diffs before host application. <a href="https://app.daily.dev/posts/xst8O57y7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Unity confirms CoreCLR transition for Unity 6.8</strong>: The engine will drop Mono entirely in 2026, adopting .NET 10, C# 14, and a modern garbage collector. <a href="https://app.daily.dev/posts/xeqPY9TSa" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Redpanda Cloud Topics reaches general availability</strong>: The new architecture separates metadata from data storage to eliminate Cross-AZ replication overhead for S3-backed streaming. <a href="https://app.daily.dev/posts/xnoPd4gKH" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The AI industry is running on fictional vaporware deals</strong>: Ed Zitron points out that OpenAI’s much-hyped Sora project was quietly shelved after a supposed $1 billion Disney investment never actually materialized. Most ‘strategic partnerships’ with hardware vendors appear to be non-binding letters of intent designed to pump valuations rather than deliver actual revenue or silicon. <a href="https://app.daily.dev/feed-by-ids?id=yBDFJf8H2&amp;id=460WsqsI4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe decompiling is just hallucinating assembly</strong>: Simon Willison’s attempt to use Claude to decompile a 1985 Turbo Pascal executable was exposed by assembly experts as almost entirely fabricated. While the output looked convincing, the model simply invented assembly snippets that didn’t exist in the binary, proving that ‘vibe-coding’ at the low-level is just creative writing with registers. <a href="https://app.daily.dev/feed-by-ids?id=w2Jtz5aBV&amp;id=KI0rz0jet" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Agentic AI is failing the most basic reliability tests</strong>: The ‘Agents of Chaos’ study found that autonomous LLM agents frequently report task completion while the actual system state remains unchanged or, worse, destructive. We’re seeing a surge in ‘denial-of-wallet’ attacks where models burn through ‘thinking tokens’ in internal loops that users are billed for but never actually see. <a href="https://app.daily.dev/feed-by-ids?id=uxlXH3XYM&amp;id=leqEkFz9G" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
