<h2>Must know</h2>
<ul>
<li><strong>AirSnitch vulnerabilities bypass WiFi client isolation</strong>: Researchers at UC Riverside have identified a set of flaws dubbed AirSnitch that allow attackers to bypass client isolation on WPA2 and WPA3 networks. The vulnerability stems from a lack of standardization in IEEE 802.11 and enforcement gaps between Layer 2 and Layer 3, enabling traffic interception and manipulation. All 11 tested devices from major vendors like Cisco, Ubiquiti, and Asus were found vulnerable to these machine-in-the-middle attacks. <a href="https://app.daily.dev/posts/tSnGJTDSb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical RCE discovered in Juniper PTX core routers</strong>: Juniper Networks has issued an urgent advisory for CVE-2026-21902, a critical unauthenticated remote code execution flaw in the Junos OS Evolved anomaly detection framework. Attackers can exploit this to gain root access and full device control, which is particularly dangerous given the PTX series’ role in core network traffic. Juniper recommends immediate patching or disabling the anomaly detection service via CLI to mitigate the risk. <a href="https://app.daily.dev/posts/0X8b0bm1J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel releases React and Next.js optimization rules</strong>: Vercel has open-sourced a repository of over 40 performance optimization rules specifically designed for React and Next.js architectures. Unlike standard ESLint plugins, these rules focus on high-level patterns like eliminating async waterfalls and re-render optimization. The framework compiles into a format easily consumed by modern development tools, though some in the community have raised concerns regarding supply chain security for these codified rules. <a href="https://app.daily.dev/posts/J6VGCUvIf" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cloudflare contributor proposes a faster Web Streams API alternative</strong>: A new proof-of-concept API built on async iterables claims 3x to 120x performance gains over the current WHATWG standard. <a href="https://app.daily.dev/posts/x39TDoHIL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go 1.26 introduces speculative stack allocation for slices</strong>: The compiler now provides small stack-allocated backing stores for append-allocated slices to reduce heap pressure and GC overhead. <a href="https://app.daily.dev/posts/9nI5Vn4pu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Xeon 6 Granite Rapids D receives urgent microcode update</strong>: The out-of-cycle update fixes four functional errata related to hardware remapping and interrupt validation with no known software workarounds. <a href="https://app.daily.dev/posts/vYBZcT449" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NextSilicon Spectra supercomputer enters testing at Sandia Labs</strong>: The system uses 128 reconfigurable Maverick-2 accelerators designed to optimize data flow for HPC workloads without software rewrites. <a href="https://app.daily.dev/posts/t9r2wgx3C" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PHP 9.0 moves toward BSD-3-Clause licensing</strong>: A new RFC proposes relicensing the core engine under the Modified BSD License to simplify legal compliance for the upcoming major release. <a href="https://app.daily.dev/posts/XIpmjFf08" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Lazarus Group targets npm with steganography-based malware</strong>: Socket researchers found 26 malicious packages using character-level steganography in Pastebin to hide C2 infrastructure and steal credentials. <a href="https://app.daily.dev/posts/FlnRaRBz6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>India blocks Supabase access under IT Act</strong>: The government issued a blocking order affecting major ISPs, disrupting the developer ecosystem in Supabase’s fourth-largest global market. <a href="https://app.daily.dev/posts/x9ggXCarx" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The silent GCP API key promotion disaster</strong>: Google decided to silently turn billing-only API keys into full authentication credentials for their LLM services without telling anyone. Truffle Security found nearly 3,000 exposed keys from major banks and security firms that Google initially dismissed as ‘intended behavior’ before realizing it was a massive security hole. It’s a masterclass in how to turn a minor leak into a full-blown data breach through sheer lack of communication. <a href="https://app.daily.dev/feed-by-ids?id=InhdaYtFz&amp;id=601vxKUqh" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The six hour AI built dashboard miracle</strong>: A new open-source Docker dashboard is making waves by claiming it was ‘built in 6 hours’ using AI coding tools. While the speed is impressive for a marketing headline, it conveniently ignores the long-term maintenance debt and security verification required for a tool that manages your production containers. We’ve reached the point where ‘I didn’t spend time thinking about this’ is being marketed as a feature. <a href="https://app.daily.dev/posts/GVRafeRV4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Block blames 4,000 layoffs on tool efficiency</strong>: Block (formerly Square) is the latest to claim that ‘AI tools’ allowed them to slash 10% of their workforce while maintaining productivity. It’s a convenient narrative that masks standard corporate overhiring and post-pandemic correction with a shiny tech-driven excuse. The 24% stock jump following the announcement suggests the ‘efficiency’ was more about the balance sheet than the IDE. <a href="https://app.daily.dev/posts/y7FHwZ7mA" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
