<h2>Must know</h2>
<ul>
<li><strong>AMD CPUs vulnerable to StackWarp attack</strong>: A new hardware vulnerability, StackWarp (CVE-2025-29943), affects AMD Zen 1-5 CPUs, including EPYC 7003, 8004, 9004, and 9005 series. This flaw allows privileged attackers to bypass SEV-SNP (Secure Encrypted Virtualization – Secure Nested Paging) protections in confidential virtual machines by manipulating the CPU stack engine. While it requires attacker privilege, it undermines a key security feature designed to isolate VMs. AMD has released microcode updates and plans further firmware patches, urging users to apply them and consider disabling hyperthreading on critical systems. <a href="https://app.daily.dev/posts/9DURDnZX3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Malicious Chrome extensions steal enterprise session tokens</strong>: Five Chrome extensions, disguised as productivity tools, were found stealing authentication session tokens from enterprise HR and ERP platforms like Workday, NetSuite, and SuccessFactors. Socket.dev researchers reported that these extensions exfiltrated cookies, bypassing credentials and MFA to grant attackers full account access. Google was notified, but the extensions had already been installed by thousands. This highlights a significant supply chain risk for enterprise users of browser extensions. <a href="https://app.daily.dev/posts/3ImoRkfEG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitLab 18.8 introduces AI-orchestrated DevOps platform</strong>: GitLab 18.8 is out, bringing its Duo Agent Platform to general availability. This platform orchestrates AI agents throughout the software development lifecycle, with features like a Planner Agent for work items and a Security Analyst Agent for vulnerability triage. It also includes a Central AI Catalog for agent management and discovery. This move by GitLab, as detailed in their release announcement, aims to automate and streamline DevOps processes using AI, particularly in security and planning. <a href="https://app.daily.dev/posts/R9WyVAVPv" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>jQuery 4.0.0 released after a decade</strong>: jQuery 4.0.0, the first major update in ten years, has been released on its 20th anniversary, focusing on removing deprecated features, dropping support for older browsers like IE10, and modernizing its codebase to ES modules, resulting in a smaller library size. <a href="https://app.daily.dev/feed-by-ids?id=5SOCKxGlX&amp;id=dThF1vPz2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft open-sources XAML Studio</strong>: Microsoft has open-sourced XAML Studio, a lightweight prototyping tool for WinUI and UWP, under the .NET Foundation, aiming for community contributions and a redesigned UI in version 2.0 with deeper WinUI 3 integration. <a href="https://app.daily.dev/posts/hUJrXK08w" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wine 11.0 stable brings major upgrades</strong>: Wine 11.0 stable is out with over 6,300 changes, including NTSYNC kernel module support for better synchronization, a completed WoW64 architecture, and upgraded graphics with EGL as the default OpenGL backend and Vulkan 1.4.335 support. <a href="https://app.daily.dev/posts/5LDn1X8et" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding tools impact enterprise IT hiring and cloud costs</strong>: India’s top IT outsourcers are drastically slowing general hiring while increasing demand for AI-specific skills, and Microsoft Copilot is showing high resource consumption on Fabric platforms, indicating AI’s dual impact on workforce and cloud infrastructure costs. <a href="https://app.daily.dev/feed-by-ids?id=DLuyoqNjG&amp;id=nKPk64Gpl" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kysely offers type-safe SQL without ORM overhead</strong>: Kysely is a TypeScript SQL query builder providing strong compile-time type safety for SQL queries, catching common database bugs without the complexity of a full ORM, and offering intuitive migrations and automatic type generation from schemas. <a href="https://app.daily.dev/posts/jBJyZRFQY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercube: a new high-performance Node.js framework</strong>: Vercube is a new Node.js framework built on srvx that aims for high performance by avoiding runtime reflection, showing significantly faster build and cold start times, and higher throughput compared to NestJS in benchmarks. <a href="https://app.daily.dev/posts/PBLtcDuNm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong><a href="http://Ultracite.ai" target="_blank" rel="noopener nofollow">Ultracite.ai</a>: zero-config formatter for JS/TS</strong>: <a href="http://Ultracite.ai" target="_blank" rel="noopener nofollow">Ultracite.ai</a> is a new zero-configuration formatter and linter for JavaScript and TypeScript, built on Rust-based tooling for speed, offering opinionated defaults, AI coding assistant integration, and cloud services for automated PR reviews. <a href="https://app.daily.dev/posts/aqdtePQaS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Sequoia Capital invests in Anthropic, ignoring ‘conflict of interest’ norms</strong>: Sequoia Capital, already holding stakes in OpenAI and xAI, is now investing in Anthropic’s $25 billion funding round. Apparently, the old VC rulebook about not funding direct competitors is out the window. OpenAI’s Sam Altman once warned investors would lose access if they funded rivals, but Sequoia seems to be playing a new game. Or maybe they just don’t care about ‘confidential info’ when there’s a potential $350 billion valuation on the table. <a href="https://app.daily.dev/posts/yuiHTajaU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NVIDIA allegedly sought pirated books for AI training</strong>: According to an amended lawsuit, NVIDIA executives allegedly contacted Anna’s Archive, a well-known pirate library, to get millions of copyrighted books for AI model training. The lawsuit claims NVIDIA was warned about the illegal nature of the content but proceeded anyway, also using other notorious piracy sites. It seems even the big players are not above dumpster diving for data, then acting surprised when authors come knocking with copyright claims. <a href="https://app.daily.dev/posts/2IcgLruSE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents get ‘psychosis’ while <a href="http://Monday.com" target="_blank" rel="noopener nofollow">Monday.com</a> fixes ‘hallucinations’</strong>: Changelog News is sounding the alarm about ‘AI agent psychosis,’ a term for erratic AI behavior, which sounds very dramatic. Meanwhile, <a href="http://Monday.com" target="_blank" rel="noopener nofollow">Monday.com</a> is busy engineering actual solutions to ‘LLM hallucinations’ in their Slack-integrated bot, by pre-computing statistics server-side and adding human-in-the-loop approvals. So, while some are busy coining scary new terms, others are actually doing the hard work of making AI agents less… well, psychotic. <a href="https://app.daily.dev/feed-by-ids?id=AJzG7x8FZ&amp;id=AS53pzdrZ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
