<h2>Must know</h2>
<ul>
<li><strong>AI coding tools are changing everything, even how we get hacked</strong>: AI coding assistants, now used by 92% of developers and generating up to 40% of new code, are creating significant gaps in traditional application security. According to Security Boulevard, these tools operate at the developer’s endpoint, bypassing existing controls and making code provenance, policy enforcement, and compliance a nightmare for auditors. This shift necessitates a pre-commit governance model to enforce policies at the moment of AI code generation, maintaining audit trails and providing real-time visibility into AI coding activity across the organization. Meanwhile, the cURL project is shutting down its bug bounty program due to an overwhelming influx of low-quality, AI-generated vulnerability reports, highlighting the double-edged sword of AI in security. <a href="https://app.daily.dev/feed-by-ids?id=4Q68q9tpN&amp;id=zNsgAYHqy&amp;id=ssDvZHbZq" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Web traffic decline hits open-source projects hard</strong>: Tailwind Labs laid off 75% of its developers due to a significant drop in website traffic and revenue. The company attributes this directly to AI-assisted coding, which reduces the need for developers to search documentation sites manually. This trend threatens the financial sustainability of open-source projects that rely on web traffic for monetization through licenses and sponsorships, raising questions about the future viability of new frameworks and libraries. This shift suggests that future open-source innovation may become increasingly dependent on AI itself, rather than human-led development. <a href="https://app.daily.dev/posts/PBAzOX1yL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Third-party apps are snooping on your sensitive data</strong>: A recent study analyzing 4,700 websites found that a staggering 64% of third-party applications are accessing sensitive data without any legitimate business justification, marking a 25% year-over-year increase. Government websites saw a jump in malicious activity from 2% to 12.9%, and education sites quadrupled their compromise rates. Widely used tools like Google Tag Manager, Shopify, and Facebook Pixel are frequently over-permissioned, with marketing and digital departments accounting for 43% of this third-party risk, according to Security Boulevard. Compromised sites connect to 2.7 times more external domains, indicating a clear link between external integrations and increased risk. <a href="https://app.daily.dev/feed-by-ids?id=FxqZcf7z0&amp;id=gPrtH4efl" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI coding assistants get a productivity boost</strong>: Q1 2026 benchmarks show AI coding tools are significantly increasing developer productivity, with Cursor users seeing a 46% increase in daily pull request throughput, and agentic AI-native tools generally outperforming traditional AI assistants. <a href="https://app.daily.dev/posts/XkFn8TQqF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel and Strapi push AI into web development</strong>: Vercel Agent now offers one-click AI code suggestions directly in the dashboard for pull request reviews, while Strapi launched <a href="http://Fimo.ai" target="_blank" rel="noopener nofollow">Fimo.ai</a>, an AI-native CMS for live production websites that enables real-time visual editing and instant rollbacks. <a href="https://app.daily.dev/feed-by-ids?id=93nUmFPYd&amp;id=f5IhxeEO5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New tools for managing AI agents</strong>: Portkey introduced the open-source MCP Gateway for centralized control of Model Context Protocol (MCP) servers, offering unified authentication, fine-grained authorization, and end-to-end observability for AI agents, while the Linux Foundation launched the Agentic AI Foundation to foster governance in this space. <a href="https://app.daily.dev/feed-by-ids?id=HxhnM7R7f&amp;id=MNBd0F6TX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>React state sync library gains traction</strong>: nuqs, a 6kB open-source library for synchronizing React application state with URL query parameters, has garnered over 9.6k GitHub stars and is used in production by companies like Supabase and Sentry, offering a type-safe, useState-like API for various React frameworks. <a href="https://app.daily.dev/posts/ZeIjZxaxs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Affordable 10GbE is here</strong>: New Realtek RTL8127 NICs are bringing affordable 10GbE connectivity to consumer systems for as little as $40, consuming under 3 watts and supporting multi-gigabit speeds, with budget-friendly switches also hitting the market. <a href="https://app.daily.dev/posts/aAkAF7k3i" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js and GitLab patch critical vulnerabilities</strong>: Zoom fixed a critical command injection vulnerability (CVE-2026-22844) in its Node Multimedia Routers, while GitLab addressed multiple high-severity flaws, including a 2FA bypass (CVE-2026-0723) and several Denial-of-Service issues. <a href="https://app.daily.dev/posts/nU967RVZ1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New open-source tools for developers</strong>: Snipplle launched as an open-source code snippet manager with version control and CLI integration, while RelateDB offers an offline-first, browser-based database schema designer, and ChartGPU provides a WebGPU-based charting library for high-performance data visualization. <a href="https://app.daily.dev/feed-by-ids?id=AIlcmWOAv&amp;id=Lhaif3YU8&amp;id=q95L7aBiO&amp;id=bruP1nBn4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI will solve all our problems, just not the ones we have now</strong>: Palantir CEO Alex Karp, speaking at Davos, boldly declared AI will eliminate the need for large-scale immigration and cut white-collar jobs by 80%, all while boosting revenue. Conveniently, he offered no third-party evidence, and his claims directly contradict reports from Deutsche Bank, Gartner, and PwC, who note that the AI ‘honeymoon is over’ and most CEOs aren’t seeing returns. Apparently, AI is a miracle cure, as long as you ignore the actual data and listen to the guy selling the cure. <a href="https://app.daily.dev/feed-by-ids?id=3s1vrBGbY&amp;id=FLsBFoZv3&amp;id=FWpexauJL&amp;id=KOoayUI82" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI sovereignty: It’s not where your data is, it’s where your models are (wink, wink)</strong>: Microsoft CEO Satya Nadella, ever the diplomat, redefined AI sovereignty at Davos. Forget those pesky data residency mandates, he argued; true sovereignty is about controlling models trained with proprietary knowledge, not where your data physically sits. This convenient reframe, coming from a company under scrutiny for data sovereignty, suggests that ‘sovereignty’ now means whatever helps big tech avoid regulatory headaches and keep their cloud services humming. <a href="https://app.daily.dev/posts/n1gYMuFrF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI wearables: Because your phone isn’t enough of a distraction</strong>: Apple is reportedly developing an AI-powered wearable pin, while OpenAI is cooking up AI earbuds, both aiming for mass market adoption with tens of millions of units. This, despite the spectacular failure of Humane AI’s pin product, which folded within two years. Apparently, the market is just clamoring for more ways to be constantly connected and surveilled, even if previous attempts have proven that nobody actually wants these things. <a href="https://app.daily.dev/feed-by-ids?id=fgglWe8Qn&amp;id=vOBU57mgd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
