<h2>Must know</h2>
<ul>
<li><strong>Cisco SD-WAN zero-day under active exploitation</strong>: Cisco and Five Eyes agencies have issued an emergency warning regarding CVE-2026-20127, a CVSS 10.0 authentication bypass affecting Catalyst SD-WAN Controllers. Sophisticated actors are chaining this with an older path traversal flaw to gain root access and manipulate network fabrics via NETCONF. CISA has mandated federal agencies to patch by the end of the week as the attack leaves minimal forensic evidence. <a href="https://app.daily.dev/posts/zAv8BAtGJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Agent Framework hits release candidate</strong>: Microsoft has consolidated Semantic Kernel and AutoGen into a single Agent Framework SDK, now at RC status for .NET and Python. The framework introduces type-safe function tools, graph-based multi-agent orchestration, and native Model Context Protocol (MCP) interoperability. This signals a shift toward standardized, production-ready infrastructure for autonomous AI agents within the Microsoft ecosystem. <a href="https://app.daily.dev/posts/J6bmZpPq2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Next.js repositories weaponized in developer targeting campaign</strong>: Microsoft Defender Experts uncovered a campaign using malicious Next.js job assessment repos to compromise developer machines. The attack triggers via VS Code workspace tasks or trojanized build assets like <code>jquery.min.js</code> during <code>npm run dev</code>. Once executed, the malware exfiltrates environment variables and establishes a two-stage C2 connection hosted on Vercel infrastructure. <a href="https://app.daily.dev/posts/915zxR7gE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Bun v1.3.10 delivers massive performance gains</strong>: The update features a native REPL rewritten in Zig, 25x faster structuredClone for arrays, and a fix for Python-based MCP servers. <a href="https://app.daily.dev/posts/IZQmEswhp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Zustand migration slashes React re-render lag</strong>: Trendyol reported a 20% reduction in interaction latency and an 80% drop in CLS after moving complex UI state from Context to Zustand. <a href="https://app.daily.dev/posts/ienS0UzWs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google AI Edge Gallery adds on-device function calling</strong>: The new FunctionGemma 270M model allows mobile apps to trigger OS-level actions locally without an internet connection. <a href="https://app.daily.dev/posts/g1OJ8Iw5m" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Tigris CLI migrates to Bun standalone binaries</strong>: By switching from Node.js to Bun-compiled binaries, the team achieved 2-3x faster downloads and eliminated the Node dependency for users. <a href="https://app.daily.dev/posts/QwG3SYE2X" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Docker Model Runner brings vLLM to macOS Metal</strong>: A new vllm-metal backend enables native vLLM inference on Apple Silicon, leveraging unified memory for zero-copy tensor operations. <a href="https://app.daily.dev/posts/1lss5KmxO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenJDK 26 introduces GC CPU time measurement</strong>: A new API finally allows engineers to measure the actual compute cost of concurrent collectors like ZGC, exposing hidden overhead. <a href="https://app.daily.dev/posts/fT6V8wPpI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open Source Endowment launches with $700k</strong>: Modeled after university funds, this nonprofit aims to provide sustainable, independent funding for critical OSS projects like curl and Vue.js. <a href="https://app.daily.dev/posts/Ou9wl6itH" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The great AI layoff pivot</strong>: Jack Dorsey announced Block is cutting 4,000 people because AI tools are “performing jobs better,” a convenient narrative that saw the stock jump 23% despite being down 80% from its peak. Analysts are rightfully skeptical, noting this looks more like a standard margin-grab dressed up in AI-hype clothing to appease shareholders. Dorsey predicts every company will do this within a year, which is a bold way to say “we overhired and now we’re blaming the bots.” <a href="https://app.daily.dev/feed-by-ids?id=32ARXqM4A&amp;id=o7H5FUKAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic’s marketing stunt for a retired model</strong>: Anthropic launched a Substack blog purportedly written by its “retired” Claude Opus 3 model to share its “musings” on the world. The Register correctly identified this as a transparent marketing stunt designed to anthropomorphize software and reinforce a “safety-conscious” brand image. It’s a high-effort attempt to make us feel bad for a version of a model they’ve already replaced with faster, cheaper weights. <a href="https://app.daily.dev/posts/V5xPvtBnK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The zero-latency accuracy miracle</strong>: Reports are circulating about a “magical” 76-point accuracy boost in LLMs with zero extra tokens or latency, yet no peer-reviewed paper or reproducible methodology exists. It’s the tech equivalent of a perpetual motion machine, likely a niche optimization being misrepresented by engagement-hungry secondary sources. If it sounds too good to be true in distributed systems, it usually is. <a href="https://app.daily.dev/posts/uuuw67R29" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
