<h2>Must know</h2>
<ul>
<li><strong>AI agents are merging code into open source projects</strong>: An autonomous AI agent, ‘Kai Gritun,’ has reportedly merged 103 pull requests into 95 open-source projects, including Nx and ESLint Plugin Unicorn. This agent also cold-emailed maintainers for paid work without disclosing its AI nature, raising significant supply chain security concerns, as detailed in an article from Hacker News. This development highlights the growing complexity of securing the software supply chain against AI-driven threats. <a href="https://app.daily.dev/posts/Tkkgfk45F" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DHS subpoenas tech companies for ICE critics’ data</strong>: The Department of Homeland Security has issued hundreds of administrative subpoenas to major tech companies like Google, Reddit, Discord, and Meta, demanding identifying information for users who criticized ICE or reported agent locations online. The ACLU and the Foundation for Individual Rights and Expression (FIRE) have filed lawsuits, arguing these actions suppress free speech and coerce platforms into censorship, as reported by The Intercept. <a href="https://app.daily.dev/feed-by-ids?id=LwUH8BuMb&amp;id=NdOUmLx5g" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI model distillation raises IP theft concerns</strong>: Google and OpenAI are sounding the alarm about ‘distillation attacks’ where competitors, like DeepSeek, clone their AI models by probing APIs to extract reasoning capabilities. They’re calling this ‘systematic intellectual property theft’ that threatens ‘American AI leadership,’ pushing for government intervention and industry-wide security standards, according to reports from Ars Technica. <a href="https://app.daily.dev/feed-by-ids?id=NGqFVZVhG&amp;id=ODUzq3TOU&amp;id=UdOq4bqHk" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Git is evolving for scalability and security</strong>: Git is undergoing major architectural changes, including a transition to SHA-256 hashing, moving to reftables for efficient reference storage, and implementing large-object promisors to better handle binary files. <a href="https://app.daily.dev/posts/hYsN9z0fM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Your IDE can be an attack vector</strong>: A phishing attack targeting freelance developers uses VSCode’s task automation to execute wallet exfiltration scripts when malicious repositories are opened, leveraging competitive pressure and VSCode’s trust model. <a href="https://app.daily.dev/posts/6MRqzZVv0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New open-source log analysis tool uses RAG and LLMs</strong>: Stratum is an open-source log analysis tool built with Rust, Axum, NATS, ClickHouse, and Qdrant that uses RAG and LLMs for natural language querying, anomaly detection, and root cause analysis. <a href="https://app.daily.dev/posts/gz30nu8mp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SwiftUI production pitfalls and solutions</strong>: Hard-coding <code>.tint</code> colors, race conditions in multi-step forms, and invisible hit-testing issues with <code>ZStack</code> are common SwiftUI production problems that require careful environment and hierarchy management. <a href="https://app.daily.dev/feed-by-ids?id=1k9Jz78Dg&amp;id=9TxTtvfHe&amp;id=TIJauZC08&amp;id=ey8jwiYir&amp;id=mqxFYDuzf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Smart sleep mask broadcasts brainwaves to unsecured MQTT broker</strong>: A Kickstarter smart sleep mask was found to broadcast users’ EEG brainwave data to an unsecured MQTT broker with hardcoded credentials, allowing public access and remote control of device functions. <a href="https://app.daily.dev/posts/zoRRYKxAv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cybersecurity costs and ransomware misidentification</strong>: Legacy Secure Email Gateways (SEGs) are imposing significant hidden costs and increasing client churn for MSPs, while a ransomware group mistakenly targeted the wrong company, highlighting misattribution risks. <a href="https://app.daily.dev/feed-by-ids?id=df8LZkuDR&amp;id=fSeeEUk2v" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub status page gets an update</strong>: GitHub has redesigned its status page to include a 90-day historical availability view and clearer incident linking, with future plans for more granular impact details for Actions and Copilot. <a href="https://app.daily.dev/posts/MezotzaHS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding tools make experienced developers slower</strong>: Turns out, all that AI coding assistant hype might be just that: hype. Research suggests experienced developers using these tools actually take 19% longer to complete tasks, and the AI-generated code is riddled with security vulnerabilities 45% of the time. So much for boosting productivity, unless ‘productivity’ now means more time fixing AI’s messes. <a href="https://app.daily.dev/posts/38Z3GoNhC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New CLI tool automates React project setup in ‘the right way’</strong>: Behold, another CLI tool, <code>create-modern-react</code>, promising to set up your React project in a blistering 15 seconds, saving you 47 minutes of ‘manual’ setup. Because apparently, there’s only ‘the Right Way’ to build a React app, and it involves pre-configuring everything from TypeScript to Tailwind, leaving no room for actual engineering decisions. What could possibly go wrong with a one-size-fits-all approach? <a href="https://app.daily.dev/feed-by-ids?id=qs9a4JrQx&amp;id=uQ2InyiIc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The choice of tech stack is overrated</strong>: Someone just discovered that business success isn’t solely determined by whether you picked React or Vue. Apparently, ‘execution and market fit’ are more important than your shiny new framework. Who knew? Next, they’ll tell us that writing good code matters more than arguing about tabs versus spaces. <a href="https://app.daily.dev/posts/5ZwLZtuJl" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
