<h2>Must know</h2>
<ul>
<li><strong>AI code generation limitations and quality concerns</strong>: SonarSource data reveals significant quality differences in Java code generated by various LLMs, with Opus 4.5 Thinking achieving the highest pass rate and lowest issue density. GPT-5.2 High, for instance, generates three times more code and introduces security vulnerabilities like SQL injection. Despite 72% of developers using AI daily, 96% distrust its correctness, and 48% admit to not always verifying AI-generated code before committing it, according to Sonar. This highlights a critical gap between AI adoption and robust verification practices, potentially leading to ‘knowledge erosion’ and review bottlenecks as AI iterates faster than humans can effectively review, as noted by a software consultancy. <a href="https://app.daily.dev/feed-by-ids?id=E02dc9OJZ&amp;id=q2sjuwRsf&amp;id=DRTczTJyG&amp;id=K8Q8uNU3E&amp;id=Kf8FXuyo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>North Korean hackers use QR codes to bypass MFA</strong>: The FBI warns that North Korean state-sponsored hackers (Kimsuky/APT43) are using malicious QR codes in spear-phishing campaigns targeting U.S. institutions. These ‘quishing’ attacks, documented in May-June 2025, embed QR codes in emails that redirect users to credential harvesting sites mimicking Microsoft 365, Okta, and VPN login pages. This technique exploits the lack of enterprise security on personal mobile devices, allowing attackers to bypass traditional endpoint detection and multi-factor authentication by stealing session tokens. The FBI recommends treating all mobile phones as managed endpoints and controlling QR-based links. <a href="https://app.daily.dev/posts/XmPhFlPf5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Russian APT28 targets strategic organizations with credential harvesting</strong>: Russian state-sponsored APT28 (Fancy Bear/BlueDelta) conducted credential theft operations from February to September 2025, targeting organizations in the Balkans, Middle East, Central Asia, and Europe. The attacks used localized phishing emails with legitimate-looking PDF decoys, leading to fake login pages for Microsoft OWA, Google, and Sophos VPN. These campaigns, which leveraged commercial VPNs and free hosting platforms, served as initial access points for intelligence gathering, demonstrating a focus on operational efficiency over technical sophistication, according to multiple sources. <a href="https://app.daily.dev/posts/bNDY7v5ay" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Vinted’s journey to a global event-driven platform</strong>: Vinted’s engineering team transitioned from a monolithic architecture to a global, event-driven platform handling over 300k requests per second, using Domain-Driven Design and a single-writer, multi-reader architecture with replicated read projections for eventual consistency. <a href="https://app.daily.dev/feed-by-ids?id=yEYp1crv1&amp;id=lUNh7QXHC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New Kubernetes database management and cloud database bundles</strong>: Percona is donating its database management platform, now OpenEverest, to the CNCF for unified PostgreSQL, MySQL, and MongoDB management on Kubernetes, while Amazon Lightsail introduced larger managed database bundles for production workloads. <a href="https://app.daily.dev/feed-by-ids?id=MhqrMxmeE&amp;id=waU9VD2zd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agent development with new tools and frameworks</strong>: VS Code introduced Agent Skills for AI agents to load specialized instructions on demand, while Anthropic released Claude Code 2.1 with forked sub-agents and session teleportation, and <a href="http://Fly.io" target="_blank" rel="noopener nofollow">Fly.io</a> introduced ‘Sprites’ for durable, stateful Linux environments for AI agents. <a href="https://app.daily.dev/feed-by-ids?id=xn90KJxf1&amp;id=WChBmOscl&amp;id=nDBQDaZMg&amp;id=HAEIV3Yfw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GPU-accelerated simulations in upcoming games and tech demos</strong>: Independent developer Zolden is creating ‘Simulario,’ a physics sandbox game using a custom GPU-based engine, while Unity’s ‘Time Ghost’ tech demo showcases new real-time graphics features like hair systems and large-scale environments. <a href="https://app.daily.dev/feed-by-ids?id=Ie1ynbbMv&amp;id=qHlkEVUn8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WebGPU updates and Kotlin bindings for Android</strong>: Chrome 144 introduces new WGSL language extensions for WebGPU, with WebGPU rolling out on Linux and the Android GPU team releasing the first alpha of Kotlin bindings for WebGPU through Jetpack’s androidx.webgpu package. <a href="https://app.daily.dev/posts/8boXOlRd2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Mid-career legal-to-software transition at Google</strong>: Zubin Pratap, a former corporate lawyer, transitioned to software engineering at Google at age 38 after teaching himself to code, highlighting the importance of communication, networking, and de-risking in a changing tech job market. <a href="https://app.daily.dev/feed-by-ids?id=9HjPijQmN&amp;id=vJhjgwWAm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open-source React scheduler component released</strong>: CalendarKit, a new open-source React calendar and scheduler component library, offers month, week, day, agenda, and resource views with features like drag-and-drop, dark mode, and TypeScript support, available in Basic and Pro versions. <a href="https://app.daily.dev/feed-by-ids?id=MBDqbsDnk&amp;id=RcOUV5N3R&amp;id=mf2DGEww0" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Snowflake acquires Observe for AIops observability, because more acquisitions always solve everything</strong>: Snowflake is acquiring Observe, an ‘AI-driven’ SRE platform, to ‘bolster observability for production AI systems.’ Apparently, this will make observability ‘more cost-effective’ than Datadog and Splunk, because nothing says cost-effective like another acquisition. The goal is to provide ‘integrated visibility across data pipelines, AI model behavior, and infrastructure health,’ which sounds suspiciously like what every other observability tool already claims to do. No financial terms, no timeline, no independent confirmation—just Snowflake’s corporate framing, because who needs details when you have AI buzzwords? <a href="https://app.daily.dev/posts/XlAd95QPv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Hooded Horse bans generative AI, calls it ‘cancerous’—because fear sells games?</strong>: Indie publisher Hooded Horse, known for Manor Lords, has instituted a ‘strict contractual ban’ on generative AI, with CEO Tim Bender calling it ‘cancerous.’ They’re so worried about AI-created assets ‘slipping’ into games that they prohibit it even for placeholder content. This bold stance, contrasting with major studios embracing AI, is linked to ‘broader copyright concerns.’ It’s almost as if a publisher is leveraging industry-wide anxieties and strong, emotional language to carve out a niche and appeal to a specific segment of the gaming community. Or maybe they just really, really hate robots. <a href="https://app.daily.dev/posts/ufoxpOMSz" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google’s AI-focused Gmail redesign: because your inbox wasn’t proactive enough</strong>: Google is launching new AI-powered features for Gmail, aiming to make it a ‘proactive inbox assistant.’ This includes AI Overviews to summarize long threads, natural language inbox queries, and ‘Help Me Write’ assistance, all powered by Gemini 3. While conversation summaries are free, the ‘advanced features’ require a paid AI Pro or Ultra subscription. So, Google is making your inbox ‘proactive’ by charging you to make it less annoying, and only for US English users initially. Because nothing says ‘productivity enhancement’ like paying extra for features that should probably just work. <a href="https://app.daily.dev/posts/8lOS5k1vH" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
