<h2>Must know</h2>
<ul>
<li><strong>AI de-anonymization ends the era of pseudonyms</strong>: Researchers from ETH Zurich and Anthropic have demonstrated a method called ESRC that uses LLMs to unmask anonymous online users with 67% accuracy. By analyzing behavioral clues and cross-referencing public data like LinkedIn, the system can identify real identities for as little as $4 per person. This capability, reported by several security outlets, effectively automates large-scale de-anonymization that was previously too labor-intensive for anyone but nation-states. <a href="https://app.daily.dev/posts/6pfAyhkf5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google API keys exposed to retroactive privilege escalation</strong>: Truffle Security discovered that legacy Google API keys, previously safe for public embedding in Maps or Firebase, were retroactively granted access to sensitive Gemini endpoints. The launch of the Generative Language API allowed these public keys to access private files and run up LLM billing without developer consent. Google has acknowledged the issue and is moving toward scoped defaults, but thousands of live keys remain vulnerable to exploitation. <a href="https://app.daily.dev/feed-by-ids?id=WmQn4YSm3&amp;id=hWSyKUcOU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fake job interviews target developers with multi-stage backdoors</strong>: Microsoft Defender Experts uncovered a sophisticated campaign where attackers use fake coding challenges to compromise developer machines. The malicious Next.js repositories execute code via VS Code tasks.json or trojanized assets like jquery.min.js to steal AWS keys and GitHub tokens. Security teams recommend using VS Code Restricted Mode and running all interview assessments in isolated virtual machines. <a href="https://app.daily.dev/posts/915zxR7gE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cilium 1.19 marks ten years with strict encryption modes</strong>: The anniversary release prioritizes security hardening, introducing strict IPsec/WireGuard modes that drop unencrypted inter-node traffic by default. <a href="https://app.daily.dev/posts/VJq8q5iXQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Agent Framework reaches release candidate status</strong>: The SDK consolidates Semantic Kernel and AutoGen into a single library for building and orchestrating multi-agent workflows in .NET and Python. <a href="https://app.daily.dev/posts/J6bmZpPq2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest slashes data latency to 15 minutes using CDC</strong>: By replacing batch ingestion with a Change Data Capture framework using Debezium and Flink, Pinterest reduced data availability lag from 24 hours to 15 minutes. <a href="https://app.daily.dev/posts/YXA7RQ7qv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenJDK 26 adds explicit GC CPU time measurement</strong>: A new API addresses the operational blind spot where modern concurrent collectors show low latency while silently consuming massive compute resources. <a href="https://app.daily.dev/posts/fT6V8wPpI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Storing Git repositories directly in PostgreSQL</strong>: The gitgres library implements libgit2 backends against Postgres, allowing unified backups and SQL joins between commit history and application data. <a href="https://app.daily.dev/posts/Ba7yln5MF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bun v1.3.10 delivers massive string slicing performance</strong>: The update features a rewritten REPL in Zig and a JavaScriptCore upgrade that makes deep rope string slicing up to 168x faster. <a href="https://app.daily.dev/posts/y0Qj7RtXG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google launches Gemini 3.1 Flash for faster image generation</strong>: Codenamed Nano Banana 2, the model aims for Pro-level quality at double the speed, supporting character consistency across multiple images. <a href="https://app.daily.dev/posts/ezdKReFDS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic starts a Substack for its retired software</strong>: Anthropic has launched a blog purportedly written by Claude Opus 3 to fulfill the model’s ‘expressed desire’ to share its musings. The Register rightly calls this a marketing stunt designed to anthropomorphize code and distract from the fact that humans are still the ones hitting the ‘publish’ button. It’s a peak example of ‘safety-conscious’ branding masking a standard engagement play. <a href="https://app.daily.dev/posts/V5xPvtBnK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The Vibe Coding trap for senior engineers</strong>: The industry is currently obsessed with ‘Vibe Coding’—delegating entire features to AI and only verifying the visual output. While it’s great for UI tweaks, critics warn it creates unmaintainable ‘black box’ codebases that pass basic tests but fail catastrophically under production load. If you can’t debug the code your agent wrote during a Black Friday outage, you haven’t increased productivity; you’ve just deferred the technical debt. <a href="https://app.daily.dev/feed-by-ids?id=TXNq3Eeop&amp;id=pY58DrOUO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Salesforce claims AI agents will end the SaaSpocalypse</strong>: Marc Benioff is aggressively pushing ‘Agentic Work Units’ as a new metric to prove that SaaS isn’t being commoditized by LLMs. This narrative conveniently ignores that most enterprise AI initiatives fail at a 95% rate due to the exact fragmented data infrastructure Salesforce helped build. Calling a workflow an ‘agent’ doesn’t magically fix the underlying data gravity problems that actually matter to platform engineers. <a href="https://app.daily.dev/feed-by-ids?id=R4O8qdc3C&amp;id=xEpzJzznp" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
