<h2>Must know</h2>
<ul>
<li><strong>Chrome zero-day vulnerability under active exploitation</strong>: Google has released an urgent update for Chrome (145.0.7632.75/76) to patch CVE-2026-2441, a high-severity use-after-free bug in its CSS font feature value map parsing. This is Chrome’s first zero-day of 2026 and is actively being exploited in the wild, allowing for arbitrary code execution within the browser sandbox. The vulnerability was reported on February 11, 2026, and the fix involves replacing a reference-based iteration with a copy to prevent modification during traversal. <a href="https://app.daily.dev/posts/ISqaRw1RF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical vulnerabilities in popular VS Code extensions disclosed</strong>: OX Security has disclosed critical vulnerabilities in four widely used VS Code extensions: Live Server (72M downloads), Code Runner (37M), Markdown Preview Enhanced (8.5M), and Microsoft’s Live Preview (11M). These flaws, affecting over 128 million installs, could lead to file theft, remote code execution, and local network reconnaissance. While Microsoft silently patched Live Preview, the maintainers of the other three extensions have not responded, leaving millions of developers at risk. <a href="https://app.daily.dev/posts/IuDICegHN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel makes webstreams 10x faster for Next.js server rendering</strong>: Vercel identified WHATWG WebStreams as a major bottleneck in Next.js server rendering due to Promise allocations and object overhead. They developed <code>fast-webstreams</code>, a drop-in replacement that routes operations through Node.js’s optimized <code>pipeline()</code> internally, achieving 10-14x throughput gains. This work is being contributed upstream to Node.js, promising significant performance improvements for React Flight byte stream patterns and other WebStream-heavy applications. <a href="https://app.daily.dev/posts/OTXPVGIi5" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Laravel adds official Svelte + Inertia starter kit</strong>: Laravel now offers an official starter kit for Svelte 5, integrating TypeScript, Inertia 2, Tailwind CSS, shadcn-svelte, and Vite, providing a robust foundation for new projects alongside existing React, Vue, and Livewire options. <a href="https://app.daily.dev/posts/runkXqODs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Interop 2026 targets new web platform features</strong>: Major browser vendors (Google, Apple, Igalia, Microsoft, Mozilla) announced Interop 2026, focusing on 15 new web platform topics including CSS <code>attr()</code>, container style queries, <code>contrast-color()</code>, and scroll-driven animations to improve cross-browser compatibility. <a href="https://app.daily.dev/feed-by-ids?id=RoxLCkIyX&amp;id=wpmh0wCvn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TanStack hotkeys library released</strong>: TanStack Hotkeys, a new type-safe, cross-platform keyboard shortcut library, offers sequence detection, key state tracking, recording functionality, and framework adapters for React, with intelligent handling of input fields and DOM scoping. <a href="https://app.daily.dev/posts/Kv2uzcMrl" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Copilot chat security flaw exposes confidential emails</strong>: Microsoft confirmed a security bug in Copilot Chat (CW1226324) that allowed the AI to bypass confidentiality labels and DLP policies, summarizing emails from users’ Sent Items and Drafts folders without authorization, with a fix rolling out since early February. <a href="https://app.daily.dev/posts/jSmIdhAQU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agent ecosystem navigates policy shifts and data challenges</strong>: Anthropic clarified its Claude Code documentation regarding OAuth token usage in third-party tools, while OpenAI partnered with Indian fintech Pine Labs to embed AI APIs, and Amazon shared a framework for evaluating agentic AI systems at scale. <a href="https://app.daily.dev/feed-by-ids?id=1UIQguzNO&amp;id=3lsZ5Vula&amp;id=D45i7bkfM&amp;id=EZOdc00Xc&amp;id=FQxtQgg9R&amp;id=FTWE8YzDG&amp;id=JlixRkBbI&amp;id=JqU9WLooM&amp;id=LKtTxw05m&amp;id=R2tIcO414" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>npm CLI v11.10.0 security enhancements released</strong>: npm CLI v11.10.0 introduces bulk OIDC trusted publishing configuration and a new <code>--allow-git</code> flag for <code>npm install</code> to explicitly control git dependencies, addressing a security vulnerability that allowed arbitrary code execution. <a href="https://app.daily.dev/posts/3xMuRnyG7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust 1.93.1 released with performance improvements</strong>: This Week in Rust highlights the release of Rust 1.93.1, a 5-10% parallel frontend performance improvement, and stabilization of <code>assert_matches</code>, alongside community content on async Rust evolution and building LLMs from scratch. <a href="https://app.daily.dev/posts/q374yMen7" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI productivity impact: Still waiting for the magic</strong>: A survey of nearly 6,000 executives by NBER found over 80% reported no measurable impact from AI on productivity or employment, despite 69% using some form of AI. Apparently, all that hype about AI transforming the workplace is still just that: hype. But don’t worry, they still anticipate AI will eliminate 1.75 million jobs by 2028, so at least it’s good for something, right? <a href="https://app.daily.dev/posts/rfmYnNc4e" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic’s C compiler: A triumph of marketing over reality</strong>: Anthropic released a marketing video claiming Claude built a C compiler ‘from scratch’ with ‘no human intervention.’ Turns out, it used 37 years of GCC test suites, an online GCC oracle, required human restarts, cost $20,000 in API calls, and couldn’t even boot Linux. But hey, ‘100,000-line functional compiler’ sounds impressive if you ignore all the inconvenient details. <a href="https://app.daily.dev/posts/0csgEkRMy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated code: The dumbest metric is back</strong>: Martin Fowler from Thoughtworks warns that AI is accelerating software development, but also risks becoming a ‘debt accelerator’ if foundational practices are absent. Meanwhile, the metric of Lines of Code (LOC) is making a dangerous comeback due to AI code generation hype, despite being discredited by computer science pioneers. Because nothing says ‘engineering excellence’ like generating a mountain of ‘instant legacy code’ that nobody fully understands. <a href="https://app.daily.dev/feed-by-ids?id=WUJRo6v7h&amp;id=alUW9sJXE&amp;id=guYQJk0m5&amp;id=sc19eWuhU&amp;id=vbdTHZjVN&amp;id=ySpIGlBP7&amp;id=ygeEuk5Vz&amp;id=zU6J5TUqH" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
