<h2>Must know</h2>
<ul>
<li><strong>Cisco SD-WAN zero-day under active exploitation</strong>: Cisco and Five Eyes agencies have issued an urgent alert regarding CVE-2026-20127, a CVSS 10.0 authentication bypass vulnerability in Catalyst SD-WAN controllers. Sophisticated threat actors are chaining this with an older path traversal flaw to gain root access and manipulate network fabric configurations. CISA has ordered federal agencies to patch by the end of the week, as the attack leaves minimal forensic evidence. <a href="https://app.daily.dev/posts/zAv8BAtGJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenJDK 26 exposes the hidden cost of garbage collection</strong>: Modern Java collectors like ZGC and G1 often hide CPU overhead behind low pause times, creating operational blind spots. OpenJDK 26 introduces a new API, including <code>MemoryMXBean.getTotalGcCpuTime()</code>, to directly measure the explicit compute cost of GC. This allows engineers to make data-driven heap sizing decisions rather than relying on misleading latency dashboards. <a href="https://app.daily.dev/feed-by-ids?id=fT6V8wPpI&amp;id=69Kj2fURA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Safe Browsing is flagging side projects as phishing</strong>: A developer’s side project was recently blacklisted by Google and 10 other vendors due to a common 302 redirect pattern from a bare domain to a subdomain. This highlights a growing trend where automated security scanners penalize legitimate new domains that mimic malicious redirection behavior. Experts recommend setting up Google Search Console immediately and avoiding bare-domain redirects to prevent being ‘banned from the internet.’ <a href="https://app.daily.dev/posts/1fmhLaLC6" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Detroit project revived to bridge Java and JavaScript</strong>: A new OpenJDK proposal aims to use V8 and CPython to allow JavaScript and Python to act as extension languages for Java apps via the FFM API. <a href="https://app.daily.dev/posts/SG2ahGmXY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>React Doctor CLI automates codebase quality audits</strong>: This new open-source tool scans React projects for 60+ rules covering hook misuse, security leaks, and performance bottlenecks with a single command. <a href="https://app.daily.dev/posts/wbVD7QroD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bun v1.3.10 delivers massive performance gains</strong>: The latest release features a native REPL rewritten in Zig and optimizations making <code>structuredClone</code> up to 25x faster for arrays. <a href="https://app.daily.dev/posts/IZQmEswhp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spring MVC benchmarks show 20 percent throughput boost</strong>: Recent tests demonstrate significant gains using read-only transactions and virtual threads in the latest Spring framework releases. <a href="https://app.daily.dev/posts/69Kj2fURA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Malicious Go module exfiltrates passwords to APT31</strong>: A package impersonating the official crypto library was found capturing credentials via <code>ReadPassword</code> and deploying the Rekoobe Linux backdoor. <a href="https://app.daily.dev/posts/hUbOU1Zfx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TypeScript officially overtakes JavaScript in developer usage</strong>: New data shows 67% of developers now use TypeScript exclusively, with teams reporting 31% faster bug fixes compared to plain JS projects. <a href="https://app.daily.dev/posts/y0Qj7RtXG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub activity scraping is the new startup spam</strong>: Developers report YC-backed startups are scraping public commit metadata to send unsolicited marketing emails without consent. <a href="https://app.daily.dev/posts/YtZeIVuyy" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The AI-driven layoff narrative is a convenient mask</strong>: Block CEO Jack Dorsey is cutting 4,000 people and claiming ‘AI does the job better,’ a move that coincidentally sent the stock up 23%. Analysts are calling bullshit, noting it’s more likely a standard financial purge dressed up in AI hype to appease shareholders. If AI were truly that efficient, they wouldn’t need a year to ‘proactively’ figure out how to use it. <a href="https://app.daily.dev/feed-by-ids?id=32ARXqM4A&amp;id=o7H5FUKAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic’s Claude Opus blog is just a marketing stunt</strong>: Anthropic launched a Substack purportedly written by their ‘retired’ Claude Opus 3 model to share its ‘musings.’ The Register rightly points out this is a transparent attempt to anthropomorphize software and reinforce a ‘safety-conscious’ brand image. It’s not a sentient AI writing a diary; it’s a PR department running a prompt through a model. <a href="https://app.daily.dev/posts/V5xPvtBnK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DIY Kubernetes is the new technical debt trap</strong>: Industry voices are now labeling custom-built Kubernetes stacks as ‘Frankenstein Platforms’ that won’t survive the AI era. While the critique of complexity is valid, the solution being pushed is—surprise—buying expensive, opinionated commercial platforms. It’s the classic ‘your open-source stack is broken, please buy our SaaS’ pivot. <a href="https://app.daily.dev/posts/MuEoJoS06" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
