<h2>Must know</h2>
<ul>
<li><strong>Next.js RCE and Axios supply chain meltdown</strong>: A critical CVSS 10.0 vulnerability in Next.js (CVE-2025-55182) is being actively exploited, allowing unauthenticated shell access via the Flight protocol. Simultaneously, the Axios NPM package was hijacked by North Korean threat actors to distribute a cross-platform trojan that bypasses 2FA by stealing session cookies. Socket reports that attackers are now specifically hunting high-impact Node.js maintainers using sophisticated social engineering to gain write access to the ecosystem’s core. <a href="https://app.daily.dev/feed-by-ids?id=ASC0RII3N&amp;id=NhYgTvEYg&amp;id=qBJM8nm0c" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub performance tanks as AI agents swarm the API</strong>: GitHub’s availability has plummeted to 90% recently, with engineering blogs admitting that the surge in traffic from AI coding agents is breaking their database scaling and failover logic. To mitigate the impact on the frontend, GitHub refactored its diff-line architecture, reducing React component counts by 74% and integrating TanStack Virtual to handle massive PRs. Critics argue the platform is neglecting core reliability to chase Copilot revenue while competitors like Cursor and Pierre gain ground. <a href="https://app.daily.dev/feed-by-ids?id=7BfUkWoqM&amp;id=DMKgp6Vib&amp;id=pKbUrE72c" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic locks down Claude for third party tools</strong>: Starting April 4, Anthropic will block Claude Pro subscribers from using their limits with third-party harnesses like OpenClaw. Users must now enable a separate pay-as-you-go ‘extra usage’ tier to connect their accounts to external tools, a move framed as capacity management for their own Claude Code and Cowork products. This shift effectively forces developers into Anthropic’s first-party ecosystem or requires double-dipping on costs. <a href="https://app.daily.dev/posts/3chswHFBr" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Module Federation 2.0 goes stable</strong>: The release brings dynamic TypeScript type hints and a decoupled runtime that supports Vite, Rspack, and Node.js SSR. <a href="https://app.daily.dev/posts/DwxOsTaJk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Proton launches Swiss-based Google Workspace rival</strong>: Proton Workspace bundles encrypted mail, docs, and a new Meet video tool using the MLS protocol for privacy-first teams. <a href="https://app.daily.dev/posts/28bbY1FFo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Apple Neural Engine finally gets an open CLI</strong>: The ‘apfel’ tool unlocks macOS’s built-in FoundationModels for local inference via an OpenAI-compatible local server. <a href="https://app.daily.dev/posts/YklInVgqT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft unifies agent frameworks</strong>: Agent Framework 1.0 merges Semantic Kernel and AutoGen into a single SDK for .NET and Python with MCP tool support. <a href="https://app.daily.dev/posts/kpCfO1x5u" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android Studio adds granular AI permissions</strong>: Developers can now explicitly whitelist or sandbox AI agent access to files, shell commands, and web endpoints. <a href="https://app.daily.dev/posts/C9Jmxmarl" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WordPress plugin builds ditch Webpack</strong>: The new @wordpress/build tool uses esbuild for zero-config, high-speed builds and automated PHP script registration. <a href="https://app.daily.dev/posts/KdxAIboWK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>View Transitions get a utility toolkit</strong>: A new npm package provides helpers for playback control, feature detection, and animation optimization for the View Transitions API. <a href="https://app.daily.dev/posts/UTG40VF0N" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The great VRAM sting of 2026</strong>: Hardware vendors are currently marketing ‘progress’ while shipping $1,000+ GPUs like the RTX 5080 with a measly 16GB of VRAM. They’re betting you’ll accept AI-generated frames as a substitute for actual silicon improvements, effectively killing the budget segment to feed the AI data center beast. <a href="https://app.daily.dev/feed-by-ids?id=OWg1KFgC4&amp;id=DKG95KGoN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI wrappers are the new subprime mortgages</strong>: With a 65% churn rate in 90 days, the ‘AI wrapper’ startup scene is proving to be a house of cards as OpenAI and Anthropic simply absorb every ‘feature’ into their core models. If your entire business model is a clever system prompt and a pretty UI, you’re not a founder; you’re a temporary unpaid beta tester for Big Tech. <a href="https://app.daily.dev/feed-by-ids?id=JEAdPfYqt&amp;id=dtLX73YC8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding is just spaghetti code with a better publicist</strong>: Andrej Karpathy’s ‘vibe coding’—blindly accepting AI output—is failing in production because, surprise, LLMs don’t actually understand system architecture. We’re seeing a wave of unmaintainable, insecure garbage code being shipped by developers who think they’re 20% faster but are actually just creating a massive technical debt bubble. <a href="https://app.daily.dev/feed-by-ids?id=W2qglkwAQ&amp;id=8JQ00Kftb&amp;id=OtWkyuw46" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
