<h2>Must know</h2>
<ul>
<li><strong>Laravel sites hit by Livewire RCE vulnerability</strong>: Multiple Laravel sites were compromised via a Livewire RCE vulnerability (CVE-2025-54068) affecting versions 3.x &lt; 3.6.4, exploiting improper serialized data handling. Attackers deployed PHP backdoors, Google-only redirects for SEO cloaking, and cryptominers, bypassing Laravel’s routing. Mitigation requires upgrading Livewire to 3.6.4+, securing <code>APP_KEY</code>, and locking <code>public/</code> directory permissions, as reported by various cybersecurity sources. <a href="https://app.daily.dev/posts/dsQkjC4Yj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SpaceX acquires xAI and plans space-based AI data centers</strong>: SpaceX has acquired xAI in a deal valued at $250 billion, creating a private company potentially worth $1.25 trillion post-IPO. Elon Musk announced plans to build AI data centers in space powered by solar energy, aiming to reduce AI computing costs and leverage Starship rockets for deployment. This consolidation merges Grok, X, Starlink, and SpaceX, raising concerns about oversight, ethics, and national security, according to multiple reports. <a href="https://app.daily.dev/posts/wMYF638eZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google disrupts IPIDEA residential proxy network</strong>: Google’s Threat Intelligence Group successfully disrupted IPIDEA, a large residential proxy network used by over 550 threat groups for espionage and cybercrime. IPIDEA secretly enrolled millions of consumer devices via embedded SDKs, turning them into exit nodes for malicious activities. Google collaborated with partners like Spur and Cloudflare to take down command-and-control domains, significantly reducing IPIDEA’s device pool. <a href="https://app.daily.dev/posts/68kBI3xUP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>PHP 8.5 introduces pipe operator for regex construction</strong>: PHP 8.5 introduces a new pipe operator, offering an alternative for building regular expressions with less code and fewer side effects compared to object-oriented builder patterns. <a href="https://app.daily.dev/posts/1OgONG8MG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Laravel 12.49.0 adds hasSole() and subquery support</strong>: Laravel 12.49.0 introduces the <code>hasSole()</code> collection method, subquery support for <code>whereBetweenColumns()</code>, and expanded enum support in session and cache methods, enhancing query flexibility and code readability. <a href="https://app.daily.dev/posts/mWv1N7sg0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Deno Deploy reaches GA and launches Sandbox for untrusted code</strong>: Deno Deploy is now generally available with Node.js framework support, integrated serverless PostgreSQL, and OpenTelemetry observability, alongside the beta launch of Deno Sandbox for running untrusted code in secure microVMs. <a href="https://app.daily.dev/posts/Jmdw76tdu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI details Codex CLI internals</strong>: OpenAI published the first in a series of articles explaining the internal design of its Codex software development agent, focusing on its agent loop architecture and strategies for managing LLM inference performance. <a href="https://app.daily.dev/posts/DWHoaTisZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Formae IaC platform expands multi-cloud support</strong>: Platform Engineering Labs announced beta multi-cloud support for its open-source IaC platform, Formae, now including Google Cloud, Azure, Oracle Cloud, and OVHcloud, along with a Plugin SDK for custom extensions. <a href="https://app.daily.dev/posts/bqzmDPKsL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PHP script optimization achieves significant performance gains</strong>: A PHP developer optimized a script processing 11 million database events, improving performance from 50,000 to 1.7 million events per second by combining SQL inserts, moving calculations to PHP, and eliminating object instantiation. <a href="https://app.daily.dev/posts/oqF9cnFsn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Strict vs loose comparison in modern PHP</strong>: Strict comparison (<code>===</code>) in PHP is superior to loose comparison (<code>==</code>) for performance, security, and predictability, with modern PHP features and upcoming deprecations favoring strict checks. <a href="https://app.daily.dev/feed-by-ids?id=WEvqi7GIn&amp;id=UGmrn1o7q" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding assistants transmit code to China</strong>: A security report from Schneier on Security claims two popular AI coding assistants, used by 1.5 million developers, are secretly transmitting ingested code to servers in China. Apparently, the purpose is to steal intellectual property. Because, you know, we totally trust these black boxes with our crown jewels, right? <a href="https://app.daily.dev/posts/puWFcrOO1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated websites: the gift that keeps on giving… security vulnerabilities</strong>: A development team used an AI tool to generate a landing page, which was promptly compromised through a vulnerable third-party package, redirecting users to gambling sites. The takeaway? AI can generate code fast, but you still need actual humans to audit dependencies and respond to security issues. Who knew? <a href="https://app.daily.dev/posts/yqL3YAYGj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents for CI/CD security: what could possibly go wrong?</strong>: AI agents are now supposedly evolving into autonomous systems for CI/CD pipeline security, performing threat modeling and self-healing. But don’t worry, they only introduce ‘new security risks’ like indirect prompt injection, excessive privileges, and non-deterministic failures. Just layer on some sandboxed runners, policy-as-code, and human-in-the-loop workflows, and everything will be fine. Probably. <a href="https://app.daily.dev/posts/ERjZhsaaZ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
