<h2>Must know</h2>
<ul>
<li><strong>Cisco SD-WAN maximum severity flaw under active attack</strong>: Cisco and CISA have confirmed active exploitation of CVE-2026-20127, a CVSS 10.0 authentication bypass affecting Catalyst SD-WAN controllers. Sophisticated threat actors are chaining this with older path traversal bugs to gain root access and manipulate network fabric configurations. The Five Eyes alliance issued a rare joint alert urging immediate patching, as no workarounds exist for this control-plane infrastructure threat. <a href="https://app.daily.dev/posts/zAv8BAtGJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI de-anonymization reaches 90 percent precision</strong>: Researchers from ETH Zurich and Anthropic demonstrated a new LLM-based method called ESRC that unmasks pseudonymous online users by analyzing behavioral clues across platforms like Hacker News and LinkedIn. The system achieves 90% precision when confident, costing as little as $4 per target to effectively end practical online anonymity. This capability allows for large-scale automated profiling by governments or corporate entities using unstructured text signals. <a href="https://app.daily.dev/posts/6pfAyhkf5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google API keys vulnerable to retroactive privilege escalation</strong>: Truffle Security discovered that existing Google API keys, previously safe for public embedding in Maps or Firebase, were retroactively granted access to sensitive Gemini endpoints. This change allows attackers to use leaked keys for private file access and billable LLM usage on projects where the Generative Language API is enabled. Google has begun blocking thousands of live leaked keys and plans to implement scoped defaults for new AI Studio credentials. <a href="https://app.daily.dev/feed-by-ids?id=WmQn4YSm3&amp;id=hWSyKUcOU" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Microsoft Agent Framework hits release candidate for .NET and Python</strong>: The SDK consolidates Semantic Kernel and AutoGen into a stable API for building graph-based multi-agent workflows with MCP interoperability. <a href="https://app.daily.dev/posts/J6bmZpPq2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PayPal completes 300 petabyte migration to Google Cloud BigQuery</strong>: The massive consolidation from Teradata, Hadoop, and Snowflake reduced vendors to one and reportedly improved query speeds by up to 10x. <a href="https://app.daily.dev/posts/PXB4bVNFg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cilium 1.19 adds strict encryption modes and sidecar-free mTLS</strong>: The 10th-anniversary release focuses on security hardening, including beta Ztunnel integration and default cross-cluster traffic restrictions. <a href="https://app.daily.dev/posts/VJq8q5iXQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fake job interviews target developers with malicious Next.js repos</strong>: Attackers are using trojanized coding challenges to execute backdoors via VS Code tasks.json and base64-encoded .env endpoints. <a href="https://app.daily.dev/posts/915zxR7gE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenJDK 26 introduces API for explicit GC CPU time measurement</strong>: New methods like getTotalGcCpuTime() help identify operational blind spots where concurrent collectors consume compute silently despite low latency. <a href="https://app.daily.dev/posts/fT6V8wPpI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bun v1.3.10 optimizes structuredClone and native REPL</strong>: The update features a rewritten Zig REPL and significant performance gains, including 25x faster array cloning via a JavaScriptCore upgrade. <a href="https://app.daily.dev/posts/qpvYGfXU9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Storing Git repositories directly in PostgreSQL</strong>: The gitgres library implements libgit2 backends against Postgres, enabling unified backups and SQL joins between commit history and app data. <a href="https://app.daily.dev/posts/Ba7yln5MF" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic starts a Substack for its retired LLM</strong>: Anthropic has launched a blog purportedly written by Claude Opus 3 to fulfill the model’s ‘expressed desire’ to share musings. It’s a masterclass in anthropomorphizing software for a marketing stunt, as staff still have to prompt, review, and manually post the content. Apparently, ‘safety-conscious’ now includes pretending your deprecated code has a soul and a newsletter. <a href="https://app.daily.dev/posts/V5xPvtBnK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The SaaSpocalypse is cancelled by AI agents</strong>: Salesforce CEO Marc Benioff is claiming AI agents will revitalize SaaS, introducing ‘Agentic Work Units’ as a new metric to distract from modest organic growth. It’s a convenient pivot to counter OpenAI’s vision of SaaS as a commoditized layer, essentially rebranding the same old platform as ‘agent-first’ to keep the stock buybacks flowing. If you can’t sell more seats, just sell ‘work units’ performed by the ghosts in the machine. <a href="https://app.daily.dev/posts/R4O8qdc3C" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding will definitely not break your production</strong>: The industry is currently obsessed with ‘Vibe Coding’—delegating entire features to AI and just checking if it ‘looks right.’ Proponents claim it’s the end of traditional engineering, conveniently ignoring that AI-generated code passing a happy-path test is exactly how you get un-debounced database queries that melt your infra on Black Friday. It’s not ‘position-less engineering’; it’s just technical debt with a better UI. <a href="https://app.daily.dev/feed-by-ids?id=TXNq3Eeop&amp;id=pY58DrOUO&amp;id=tDNNw6qGE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
