<h2>Must know</h2>
<ul>
<li><strong>OpenAI hits 730 billion valuation via circular compute deals</strong>: OpenAI secured $110 billion in new funding from Amazon, Nvidia, and SoftBank, but the deal structure is heavily tied to infrastructure commitments rather than pure cash. Amazon’s $50 billion contribution is largely a compute credit for its Trainium accelerators, while Nvidia’s $30 billion is linked to deploying five gigawatts of its upcoming Vera Rubin systems. This arrangement effectively guarantees returns for the investors while inflating OpenAI’s valuation to nearly three-quarters of a trillion dollars. <a href="https://app.daily.dev/feed-by-ids?id=8imM4YubL&amp;id=ShShzSJ3B" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google API keys silently granted Gemini access</strong>: Truffle Security researchers discovered that GCP API keys, originally intended for billing, were quietly upgraded by Google to act as authentication credentials for the Gemini AI API without notifying developers. A scan revealed nearly 3,000 exposed keys belonging to major financial institutions and security firms, potentially allowing attackers to access private datasets or rack up massive API bills. Google initially dismissed the report as intended behavior before acknowledging it as a bug and restricting the affected keys. <a href="https://app.daily.dev/feed-by-ids?id=InhdaYtFz&amp;id=0amBk9Q3T" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AirSnitch vulnerabilities bypass WiFi client isolation</strong>: Researchers at UC Riverside have detailed ‘AirSnitch,’ a set of flaws in the IEEE 802.11 standard that allow attackers to bypass client isolation on encrypted WPA2 and WPA3 networks. The vulnerability stems from a lack of standardization in how Layer 2 and Layer 3 network stacks bind device identities, enabling machine-in-the-middle attacks even on enterprise-grade hardware. All 11 tested devices from vendors like Cisco, Ubiquiti, and Netgear were found to be vulnerable to traffic interception. <a href="https://app.daily.dev/posts/tSnGJTDSb" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Vercel open sources React optimization rules for AI agents</strong>: A new repository of 40+ architectural rules, such as eliminating async waterfalls, is designed specifically for consumption by tools like Claude Code and Cursor. <a href="https://app.daily.dev/posts/J6VGCUvIf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare proposes async iterable alternative to Web Streams API</strong>: A technical critique argues the current WHATWG standard is fundamentally broken, offering a pull-based alternative that runs up to 120x faster in benchmarks. <a href="https://app.daily.dev/posts/x39TDoHIL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Medidata slashes EKS costs by 80 percent via Snowflake Iceberg</strong>: By migrating from Apache Flink and Kafka to Snowflake’s Catalog Linked Database, the team eliminated bloated RocksDB state and costly infinite retention storage. <a href="https://app.daily.dev/posts/LeD5yWgOv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go 1.26 introduces speculative stack allocation for slices</strong>: The upcoming release reduces GC pressure by automatically moving small slice allocations from the heap to the stack, including variable-sized make calls. <a href="https://app.daily.dev/posts/9nI5Vn4pu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NextSilicon reconfigurable supercomputer enters testing at Sandia</strong>: The Spectra system uses 128 Maverick-2 chips that reconfigure hardware data flow per workload, claiming 2x the speed of Nvidia Blackwell for HPC benchmarks. <a href="https://app.daily.dev/posts/t9r2wgx3C" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Confluent Kafka Python client reaches async GA</strong>: Version 2.13.0 brings native asyncio support, deterministic partitioners, and full type hints to the Python client library. <a href="https://app.daily.dev/posts/XxtrJwDiH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>India blocks Supabase access under IT Act</strong>: The government issued a sudden blocking order affecting major ISPs, disrupting the developer ecosystem in Supabase’s fourth-largest global market. <a href="https://app.daily.dev/posts/x9ggXCarx" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The 200 dollar per month Perplexity Computer</strong>: Perplexity is pivoting to ‘GDP-moving decisions’ by launching an agentic tool that orchestrates 19 different models for a cool $200 monthly subscription. It’s a classic pivot away from a failing ad model toward ‘enterprise value,’ essentially charging a premium to act as a glorified router for APIs you probably already pay for. They’re betting you’ll pay a 10x markup for the privilege of letting an agent ‘autonomously’ burn through your tokens. <a href="https://app.daily.dev/posts/JYBUJ8DSb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>StegaBin and the North Korean npm ghost</strong>: Lazarus Group is now hiding C2 infrastructure inside Pastebin essays using character-level steganography, because apparently, standard obfuscation was too mainstream. Socket detected 26 of these packages within six minutes, proving that while the hackers are getting creative with whitespace, they’re still failing the most basic automated checks. It’s a high-effort way to deliver a RAT that still gets caught by the digital equivalent of a mall security guard. <a href="https://app.daily.dev/posts/FlnRaRBz6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The six hour AI dashboard miracle</strong>: A new Docker dashboard claims to have been built in exactly six hours using Codex and Cline AI, because apparently, we’re measuring engineering quality by stopwatch now. While ‘zero configuration’ sounds nice, the marketing leans heavily on the ‘AI built this’ trope to distract from the fact that it’s a TypeScript wrapper around basic Docker commands. It’s the latest entry in the ‘look what my prompt did’ category of software development. <a href="https://app.daily.dev/posts/GVRafeRV4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
