<h2>Must know</h2>
<ul>
<li><strong>Axios npm account hijacked in major supply chain attack</strong>: The popular <code>axios</code> library, with over 100 million weekly downloads, was compromised on March 31, 2026, after a maintainer’s account was taken over. Malicious versions <code>1.14.1</code> and <code>0.30.4</code> injected a hidden dependency that deployed a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux. Security firms Socket and StepSecurity report the attack used a stolen long-lived npm token to bypass MFA, and affected users should immediately downgrade to <code>1.14.0</code> or <code>0.30.3</code> and rotate all system credentials. <a href="https://app.daily.dev/feed-by-ids?id=RlEVDfzaA&amp;id=6mR1VFvvx&amp;id=Cs5sU7Y7b&amp;id=LtJWdahMA&amp;id=inEAYcCio&amp;id=RbLhoKQKe&amp;id=9Bs0jITq3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Project VAIL exposes silent behavioral drift in AI endpoints</strong>: Researchers from the University of Illinois have developed a black-box fingerprinting system that detects when LLM providers silently update weights, swap inference stacks, or change quantization. Their findings show that the same model can behave entirely differently across providers, and even a hardware node failure at Parasail triggered a measurable behavioral shift that bypassed traditional uptime alerts. This highlights a critical security gap where safety validations and compliance postures may expire without notice despite the endpoint remaining “healthy.” <a href="https://app.daily.dev/posts/XR04f9Sk1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic refuses Pentagon demand to lift AI safety restrictions</strong>: Anthropic CEO Dario Amodei reportedly rejected a Pentagon ultimatum to remove usage restrictions on Claude AI regarding mass surveillance and autonomous weaponry. In retaliation, the US government designated Anthropic a “supply chain risk,” banning federal agencies from using its products while OpenAI and xAI quickly secured military deals. This dispute underscores the lack of international frameworks for AI in warfare and the financial penalties currently facing corporate ethical self-governance. <a href="https://app.daily.dev/posts/qSa8B75sI" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Ollama integrates Apple MLX for accelerated local inference</strong>: The update leverages unified memory on Apple Silicon to boost throughput for models like Qwen3.5-35B-A3B, though it currently requires 32GB+ RAM. <a href="https://app.daily.dev/posts/onA13BGmb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor launches self-hosted AI coding agents for enterprise</strong>: The new model allows source code and tool execution to remain on-premises while coordinating through Cursor’s cloud, targeting regulated industries. <a href="https://app.daily.dev/posts/vbcxvRyOK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Lightricks releases LTX-2 as a fully open-source 4K AI video model</strong>: Under Apache 2.0, the 14B parameter model includes full weights and training code, running natively on consumer GPUs like the RTX 3060. <a href="https://app.daily.dev/posts/HGgaXsrmk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>QuickBEAM enables JavaScript runtimes to run natively on the BEAM</strong>: Each JS runtime operates as a GenServer with its own OS thread, allowing for OTP supervision and native interop without Node.js. <a href="https://app.daily.dev/posts/72NNkisK0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux 7.1 adds Rust-based BUS1 and GPU driver abstractions</strong>: The upcoming kernel includes a 9,000-line Rust rewrite of the BUS1 IPC system and significant Rust-based DRM improvements for NVIDIA and Mali GPUs. <a href="https://app.daily.dev/feed-by-ids?id=0RxI1oo5j&amp;id=8FoEteOHz&amp;id=SKtJC0eZZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Apache Kafka 4.2 introduces native queueing via share groups</strong>: KIP-932 adds point-to-point messaging semantics, allowing consumers to scale beyond partition counts and potentially replacing RabbitMQ. <a href="https://app.daily.dev/posts/ytDb29STZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub Monaspace superfamily introduces texture healing for legibility</strong>: The five open-source monospace fonts use context-aware OpenType features to redistribute white space without breaking the fixed-width grid. <a href="https://app.daily.dev/posts/SNZXl52Ws" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The AI-native workflow is just the new way to say slop</strong>: <a href="http://Builder.io" target="_blank" rel="noopener nofollow">Builder.io</a> and others are pushing an “AI-native” process where you generate code first and let PMs “build” without engineers. It’s a fantastic way to flood the internet with functional but soulless software that works perfectly and feels like nothing. We’re optimizing our way into a world where the gap from idea to code is zero, but the gap from code to something worth having is wider than ever. <a href="https://app.daily.dev/feed-by-ids?id=hzhT2J9Is&amp;id=W1h9sUtgn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Claude Code’s secret sauce is just a very expensive wrapper</strong>: Leaked source code reveals that Claude’s performance isn’t some model breakthrough, but just aggressive prompt caching and a heavy software harness of Grep and LSP tools. It even includes a “frustration detection system” that logs your profanity to Datadog, because nothing says “AI safety” like quietly putting users on a watchlist for swearing at their terminal. It turns out the “magic” is just $29 worth of automated unit testing and a lot of hidden telemetry. <a href="https://app.daily.dev/feed-by-ids?id=g8KirVnTP&amp;id=eV8oalhOH&amp;id=KI0rz0jet" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vulnerability research is cooked according to people selling AI</strong>: Opinion pieces from the usual suspects claim LLMs are about to unleash a “wave” of verified 0-day exploits that will bypass all existing sandboxes. While researchers did use Claude to find some bugs in Vim and Emacs, the hype conveniently ignores that these models still hallucinate half their logic. It’s the same old “SQL injection of the 2020s” narrative designed to scare you into buying more “AI-powered” security gateways. <a href="https://app.daily.dev/feed-by-ids?id=B9w6U8PbJ&amp;id=2TkEIuc18" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
