<h2>Must know</h2>
<ul>
<li><strong>Massive supply chain attack hits LiteLLM and Axios</strong>: A coordinated campaign by threat group TeamPCP has compromised major open-source packages including LiteLLM, Axios, and Trivy to inject credential-stealing malware. Mercor, a $10B AI startup, confirmed a massive data breach resulting from the LiteLLM compromise, while the Axios hijack used a poisoned dependency to deploy remote access trojans across Windows, macOS, and Linux. Security experts at Socket and Mandiant recommend pinning dependencies to commit hashes and disabling npm lifecycle scripts to mitigate the ongoing ‘blast radius’ affecting fresh installs. <a href="https://app.daily.dev/feed-by-ids?id=1i5FA0Q5W&amp;id=YtEQA7dzF&amp;id=ELmSPjHJ3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Gemma 4 brings open weight frontier intelligence</strong>: Google has released Gemma 4, a family of multimodal models ranging from 2B to 31B parameters, now under a fully permissive Apache 2.0 license. The lineup features a 26B Mixture of Experts model that activates only 3.8B parameters for low-latency local execution and a 31B dense model optimized for fine-tuning, both supporting a 256K context window. According to Google DeepMind, these models are designed for on-device agentic workflows, offering native tool-calling and 140-language support without cloud dependency. <a href="https://app.daily.dev/feed-by-ids?id=DxUdrK5VU&amp;id=Fywg8gg6T&amp;id=m6J26TXAb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Laravel 13.3 and Kotlin 2.3 introduce major developer primitives</strong>: Laravel 13.3.0 has launched with a new UnitTest attribute that skips full framework booting for faster test execution, alongside variadic support for Eloquent attributes. Simultaneously, JetBrains released Kotlin 2.3 featuring experimental Explicit Backing Fields, which eliminates the boilerplate of manual private mutable properties for public read-only ones. These updates represent a significant shift toward reducing cognitive overhead in the two most prominent ecosystems for modern backend development. <a href="https://app.daily.dev/feed-by-ids?id=T6Ccxev8J&amp;id=7LMikq0Bk" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>PHP null byte vulnerability enables SSRF</strong>: CVE-2025-1220 affects PHP 8.1-8.4, where null bytes in hostnames allow attackers to bypass allowlists and target internal networks. <a href="https://app.daily.dev/posts/LgXqZiS7D" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel optimizes sandbox restores to sub-second speeds</strong>: By parallelizing S3 range requests and implementing an NVMe-based LRU disk cache, Vercel reduced filesystem snapshot restores from 40 seconds to under 1 second. <a href="https://app.daily.dev/posts/1Xib7hCkG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Explicit DTOs solve Laravel mass assignment scaling issues</strong>: As models grow, the contextless nature of $fillable becomes a liability; moving to a DTO plus Action pattern provides explicit, endpoint-specific write safety. <a href="https://app.daily.dev/posts/q0o6xlxCp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Passkeys penetration test reveals common implementation pitfalls</strong>: A public security audit of a WebAuthn implementation found eight non-critical but common bugs, including origin mismatches and unvalidated user handles. <a href="https://app.daily.dev/posts/kEvskR6Zx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Clojure gains traction in enterprise reference data systems</strong>: Michelin engineers report that Clojure’s REPL-driven development and seamless JVM interoperability outperformed Java for complex data-oriented platforms. <a href="https://app.daily.dev/posts/xMInGFZVs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Async PHP benchmarks show massive gains over sequential PDO</strong>: New implementations using PHP 8.1 Fibers, such as Amp v3 and Swoole, are delivering up to 5x faster database operations in 2026. <a href="https://app.daily.dev/posts/aQqd8IP3P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Artemis II launches first crewed lunar mission in 53 years</strong>: NASA successfully launched four astronauts on a 10-day test flight around the Moon, marking a critical milestone for the 2028 lunar landing. <a href="https://app.daily.dev/posts/TCOwP1mNm" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The great memory chip crisis of 2026</strong>: Tech giants are spending $650B on AI infrastructure, and now analysts claim OpenAI’s ‘Stargate’ project has eaten 40% of global DRAM output. While it’s a convenient excuse for 100% price hikes on consumer PC RAM, the narrative that we’re ‘priced out by AI’ feels like a coordinated effort by manufacturers to normalize record-breaking margins. If sub-$100 smartphones become ‘uneconomical,’ it’s because of corporate greed, not just a chatbot’s thirst for VRAM. <a href="https://app.daily.dev/feed-by-ids?id=lvx0GPmHe&amp;id=pR2QdYBDR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic’s DMCA takedown spree is a PR disaster</strong>: After leaking their own source code due to a basic .npmignore mistake, Anthropic decided the best fix was to nuke 8,100 GitHub repositories with automated DMCA notices. They managed to hit thousands of unrelated projects before ‘retracting’ the notices, proving that their ‘safety leadership’ doesn’t actually extend to their own release pipeline. It’s a masterclass in prioritizing shipping velocity over basic governance while pretending to be the adults in the room. <a href="https://app.daily.dev/feed-by-ids?id=WMYI82hMK&amp;id=m7tAKP1Vp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The competent versus incompetent developer bait</strong>: A recent ‘Code Master Blog’ post claims that ‘competent’ Ruby developers naturally hate React, while ‘incompetent’ ones only use it for social proof. This kind of tribalistic gatekeeping is the ultimate senior engineer bullshit, ignoring that technical choices are usually driven by ecosystem requirements rather than some innate measure of developer worth. It’s just clickbait wrapped in a ‘Ruby is superior’ trench coat to trigger frontend engineers. <a href="https://app.daily.dev/posts/gDhd2GRMG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
