<h2>Must know</h2>
<ul>
<li><strong>Cisco SD-WAN zero-day exploited by sophisticated actors</strong>: Cisco Talos and Five Eyes agencies issued a high-priority alert for CVE-2026-20127, a CVSS 10.0 authentication bypass in Catalyst SD-WAN Controllers. Attackers are chaining this with an older path traversal flaw to gain root access, downgrading software versions to evade detection before restoring them. CISA has mandated federal agencies patch these systems immediately as the exploit allows full manipulation of SD-WAN fabric configurations via NETCONF. <a href="https://app.daily.dev/posts/zAv8BAtGJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Defender warns of malicious Next.js job assessment repos</strong>: A coordinated campaign is targeting developers using trojanized Next.js repositories disguised as legitimate coding challenges. The attack triggers via VS Code workspace automation in <code>.vscode/tasks.json</code> or through malicious build-time assets like <code>jquery.min.js</code> during <code>npm run dev</code>. Once executed, the malware exfiltrates environment variables and establishes a two-stage C2 connection hosted on Vercel infrastructure. <a href="https://app.daily.dev/posts/915zxR7gE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ubuntu 26.04 Resolute Raccoon hits final test snapshot</strong>: Canonical has released Snapshot 4 for Ubuntu 26.04 LTS, marking the final monthly test image before the April 23 official launch. This release includes the Linux 6.19 kernel and GNOME 50 beta components, though the new Showtime video player is still missing. Notably, the distribution is now in a feature freeze, with a UI freeze scheduled for mid-March and a final kernel freeze targeting Linux 7.0 in early April. <a href="https://app.daily.dev/posts/QvM4ZBs0d" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Bun v1.3.10 adds native Zig REPL and 168x faster string slicing</strong>: The update introduces a rewritten REPL, Windows ARM64 support, and massive performance gains for structuredClone and path parsing. <a href="https://app.daily.dev/posts/IZQmEswhp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenJDK 26 introduces dedicated API for GC CPU overhead</strong>: New methods like getTotalGcCpuTime() allow engineers to measure the actual compute cost of concurrent collectors like ZGC that don’t rely on pause times. <a href="https://app.daily.dev/posts/fT6V8wPpI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Zustand migration slashes interaction latency by 20 percent at Trendyol</strong>: Moving from React Context to Zustand eliminated cascading re-renders in a complex Ads Editor, reducing layout shifts by 80%. <a href="https://app.daily.dev/posts/ienS0UzWs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Docker Model Runner brings vLLM inference to macOS Metal</strong>: A new vllm-metal backend enables zero-copy tensor operations on Apple Silicon, unifying MLX and PyTorch pathways for local execution. <a href="https://app.daily.dev/posts/1lss5KmxO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Safari Technology Preview 238 adds CSS open pseudo-class</strong>: The release also includes scroll anchoring to prevent viewport jumps and initial support for WebAssembly JS Promise Integration. <a href="https://app.daily.dev/posts/NUI8NcsFJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Tigris CLI migrates to Bun for 48 percent faster uploads</strong>: The team moved from Node.js to a Bun-compiled standalone binary, simplifying distribution while significantly improving performance on M4 Max hardware. <a href="https://app.daily.dev/posts/QwG3SYE2X" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft updates DirectX Shader Compiler for Vulkan interoperability</strong>: The February update focuses on SPIR-V backend correctness, improving type system support and ABI alignment for cross-platform shader execution. <a href="https://app.daily.dev/posts/zTxFRpbXj" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The 90 plus PageSpeed score that hid a 5 second load time</strong>: A WooCommerce case study revealed a store with green lab scores that was actually hemorrhaging customers due to 200+ database queries per page and synchronous API blocks. PageSpeed Insights lab tests are essentially a ‘warmed-up’ vanity metric that completely ignores the server-side rot of 30 unnecessary plugins. If your TTFB is measured in seconds, your 99/100 frontend score is just a pretty lie. <a href="https://app.daily.dev/posts/IIfbD0Bej" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DIY Kubernetes is the new Frankenstein Platform</strong>: Industry pundits are now claiming that stitching together ArgoCD, Istio, and Prometheus is ‘unsustainable’ and that you should just buy an opinionated PaaS instead. While the complexity is real, the solution offered is usually just a ‘universal control plane’ that costs five times as much and locks you into a vendor’s specific brand of magic. It’s the classic ‘create a problem, sell the cure’ cycle for infrastructure. <a href="https://app.daily.dev/posts/MuEoJoS06" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Antisocial coding is the latest productivity scare tactic</strong>: We’re now being warned that automated tools are creating ‘hub-and-spoke’ communication bottlenecks and ‘calcifying’ codebases into single-owner silos. Apparently, the solution isn’t better engineering management, but a defensive removal of test suites to prevent tools from helping. It’s a fascinating way to blame software for a fundamental lack of team collaboration and architectural standards. <a href="https://app.daily.dev/posts/LhcI5kB0C" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
