<h2>Must know</h2>
<ul>
<li><strong>Cisco SD-WAN zero-day exploitation triggers international alert</strong>: Cisco Talos and Five Eyes agencies have issued a rare joint warning regarding a maximum-severity (CVSS 10.0) authentication bypass in Catalyst SD-WAN Controllers. Threat actor UAT-8616 is actively chaining this zero-day with an older path traversal flaw to gain root access and manipulate network fabric configurations. CISA has ordered federal agencies to patch by the end of the week as the attackers leave minimal forensic evidence behind. <a href="https://app.daily.dev/posts/zAv8BAtGJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Agent Framework hits release candidate status</strong>: Microsoft has consolidated its Semantic Kernel and AutoGen efforts into a single, feature-complete SDK for .NET and Python. The framework supports graph-based multi-agent workflows, type-safe function calling, and human-in-the-loop checkpoints. This move signals a shift toward standardized, production-ready orchestration for autonomous AI agents in enterprise environments. <a href="https://app.daily.dev/posts/J6bmZpPq2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Next.js repositories weaponized to target developers</strong>: Microsoft Defender Experts have uncovered a campaign using malicious Next.js job assessment projects to compromise developer workstations. The attack triggers via VS Code workspace automation or trojanized build assets like <code>jquery.min.js</code> during <code>npm run dev</code>. Once executed, the malware exfiltrates environment variables and establishes a two-stage C2 connection via Vercel-hosted domains. <a href="https://app.daily.dev/posts/915zxR7gE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Google Gemini 3.1 Flash Image launches with character consistency</strong>: Internally dubbed Nano Banana 2, the model tracks up to five characters across storyboards and offers 4K upscaling for production workflows. <a href="https://app.daily.dev/posts/ezdKReFDS" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenJDK 26 introduces direct GC CPU overhead measurement</strong>: A new API finally exposes the hidden compute cost of concurrent collectors like ZGC, allowing for more informed heap sizing decisions. <a href="https://app.daily.dev/posts/fT6V8wPpI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bun v1.3.10 adds native REPL and Windows ARM64 support</strong>: The update includes a Zig-rewritten REPL and massive performance gains for <code>structuredClone</code> and path parsing via a JavaScriptCore upgrade. <a href="https://app.daily.dev/posts/IZQmEswhp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open Source Endowment launches to fund critical infrastructure</strong>: Modeled after university funds, this nonprofit aims to provide sustainable income for independent projects like curl and ClickHouse. <a href="https://app.daily.dev/feed-by-ids?id=Ou9wl6itH&amp;id=fRs0oZgID" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quarkus 3.32 integrates Project Leyden for 80ms startups</strong>: By leveraging JVM AOT compilation via OpenJDK 25, the framework has slashed startup times for minimal applications by nearly 80%. <a href="https://app.daily.dev/posts/ZcUprqw4E" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic patches RCE flaws in Claude Code tool</strong>: Researchers found vulnerabilities that allowed arbitrary shell execution and API key theft simply by opening a malicious repository. <a href="https://app.daily.dev/posts/j81sIdgwK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SSH-based snake game renders 100M pixels per second</strong>: A technical deep dive reveals how forking Go’s crypto library and hand-rolling string functions enabled 2,500 concurrent users over SSH. <a href="https://app.daily.dev/posts/WcmUY5ncO" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Block cuts 4,000 staff and blames the AI boogeyman</strong>: Jack Dorsey is claiming that 40% of his workforce is being replaced because ‘AI tools perform jobs better,’ conveniently ignoring that the stock jumped 23% on the news. It’s a classic pivot: if you can’t grow revenue, just fire half the company and tell Wall Street the robots are doing the work. Expect every struggling fintech to copy-paste this ‘AI-driven’ layoff script by Q3. <a href="https://app.daily.dev/feed-by-ids?id=32ARXqM4A&amp;id=o7H5FUKAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic’s Claude Opus 3 starts a Substack</strong>: In a move that defines ‘marketing stunt,’ Anthropic launched a blog purportedly written by their ‘retired’ model to share its ‘musings.’ Anthropomorphizing software to this degree is a transparent attempt to reinforce their ‘safety-conscious’ brand while distracting from actual technical limitations. It’s not a digital soul; it’s a glorified autocomplete with a PR team. <a href="https://app.daily.dev/posts/V5xPvtBnK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The 95 percent AI failure rate is a data problem</strong>: Consultants are currently flooding the zone with reports claiming enterprise AI fails because your ‘data infrastructure is stale.’ While true that batch ETL is a relic, these reports—often sponsored by real-time database vendors—conveniently suggest that buying their specific HTAP platform is the only way to save your failing chatbot. It’s the same ‘digital transformation’ snake oil, just with a new LLM-flavored label. <a href="https://app.daily.dev/feed-by-ids?id=3ECYGqFq1&amp;id=xEpzJzznp" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
