<h2>Must know</h2>
<ul>
<li><strong>AI unmasks pseudonymous users for four dollars</strong>: Researchers from ETH Zurich and Anthropic have demonstrated a method called ESRC that de-anonymizes online users with 67% accuracy by cross-referencing behavioral clues with public data. The system, which identified over 300 Hacker News users during testing, costs as little as $4 per person to run. This effectively signals the end of practical online anonymity, as LLMs can now extract identity signals from unstructured text across disparate platforms. <a href="https://app.daily.dev/posts/6pfAyhkf5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google API keys suffer retroactive privilege escalation</strong>: Truffle Security discovered that existing Google API keys, previously safe for public embedding in Maps or Firebase, were retroactively granted access to sensitive Gemini endpoints. This change allowed public keys to access private files and billable LLM usage without developer notification, affecting nearly 3,000 live keys at major firms. Google has begun blocking leaked keys and plans to make new AI Studio keys restricted by default to mitigate the fallout. <a href="https://app.daily.dev/feed-by-ids?id=WmQn4YSm3&amp;id=hWSyKUcOU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cisco SD-WAN critical flaw under active attack</strong>: A maximum severity CVSS 10.0 vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN is being exploited by the threat group UAT-8616 to gain root access and persistent footholds. The Five Eyes alliance issued a rare joint alert urging immediate patching, as the attackers are chaining this with older flaws to manipulate network fabric configurations. There are no workarounds; organizations must upgrade to fixed versions by the end of the week to prevent infrastructure compromise. <a href="https://app.daily.dev/posts/zAv8BAtGJ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Microsoft Agent Framework hits release candidate</strong>: The SDK consolidates Semantic Kernel and AutoGen into a unified tool for building graph-based multi-agent workflows in .NET and Python. <a href="https://app.daily.dev/posts/J6bmZpPq2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bun v1.3.10 delivers massive string slicing gains</strong>: The update features a rewritten native REPL in Zig and performance boosts including 168x faster deep rope string slicing via JavaScriptCore. <a href="https://app.daily.dev/posts/qpvYGfXU9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenJDK 26 adds direct GC CPU measurement</strong>: A new API addresses the operational blind spot where concurrent collectors show low latency but consume significant silent compute overhead. <a href="https://app.daily.dev/posts/fT6V8wPpI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WebAssembly Component Model aims to kill JS glue</strong>: Mozilla is pushing a standardized executable format that allows Wasm to access Web APIs directly, potentially improving DOM performance by 45%. <a href="https://app.daily.dev/posts/esExmylTZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest slashes data latency to 15 minutes</strong>: By moving from batch processing to a CDC-powered framework using Debezium and Apache Iceberg, the team reduced ingestion lag from 24 hours. <a href="https://app.daily.dev/posts/YXA7RQ7qv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cilium 1.19 celebrates a decade with strict security</strong>: The anniversary release introduces sidecar-free mutual authentication via Ztunnel and strict encryption modes for IPsec and WireGuard. <a href="https://app.daily.dev/posts/VJq8q5iXQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Gemini 3.1 Flash Image launches</strong>: The new model, codenamed Nano Banana 2, offers Pro-level quality at twice the speed with support for 4K resolution and character consistency. <a href="https://app.daily.dev/posts/ezdKReFDS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic gives its retired LLM a Substack</strong>: In a peak display of corporate anthropomorphism, Anthropic claims Claude Opus 3 had an ‘expressed desire’ to share its musings via a blog. The Register rightly calls this a marketing stunt, as the ‘retired’ software is simply being prompted by staff who then pinky-swear not to edit the output. It’s a clever way to keep an old model relevant while pretending it has a soul and a hobby. <a href="https://app.daily.dev/posts/V5xPvtBnK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The SaaSpocalypse is cancelled by AI agents</strong>: Salesforce CEO Marc Benioff is aggressively pushing the narrative that AI agents will ‘revitalize’ SaaS, conveniently ignoring that his new ‘Agentic Work Units’ metric is just a fancy way to charge for things we used to call ‘features.’ While he claims SaaS is the top of the AI stack, OpenAI is busy making sure SaaS becomes the commoditized plumbing underneath it. It’s a classic battle of who gets to own the rent-seeking layer of the future. <a href="https://app.daily.dev/feed-by-ids?id=R4O8qdc3C&amp;id=pY58DrOUO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding is the new technical debt</strong>: The industry is currently obsessed with ‘Vibe Coding’—delegating everything to AI and just checking if the UI looks right. Proponents claim it’s the future of development, but senior engineers warn it’s just a high-speed lane to unmaintainable codebases that pass tests but explode during a Black Friday traffic spike. It turns out that ‘vibing’ your way through a database schema doesn’t actually replace understanding how a database works. <a href="https://app.daily.dev/feed-by-ids?id=TXNq3Eeop&amp;id=tDNNw6qGE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
