<h2>Must know</h2>
<ul>
<li><strong>React server components hit with DoS vulnerabilities</strong>: Multiple denial-of-service vulnerabilities (CVE-2026-23864) have been found in React Server Components, affecting versions 19.0.x through 19.2.x, and by extension, Next.js versions 13.x to 16.x. These flaws can lead to server crashes and excessive CPU usage via crafted HTTP requests. Vercel has implemented WAF mitigations, and immediate upgrades to patched versions are crucial for remediation, as reported by security bulletins. <a href="https://app.daily.dev/posts/igYAcLEa7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubernetes RBAC vulnerability allows cluster-wide remote code execution</strong>: A critical authorization bypass vulnerability in Kubernetes Role-Based Access Control (RBAC) allows remote code execution in any Pod with the commonly granted <code>nodes/proxy GET</code> permission. This flaw, which affects 69 Helm charts including those for Prometheus and Grafana, stems from Kubelet authorizing WebSocket <code>/exec</code> requests based on initial HTTP GET, bypassing proper command execution checks. The Kubernetes Security Team considers this ‘working as intended,’ recommending an architectural solution that doesn’t address the immediate threat, as detailed by security researchers. <a href="https://app.daily.dev/feed-by-ids?id=YKjgFzDSZ&amp;id=wlbhCOZ7B" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open source projects struggle as AI coding tools reduce engagement</strong>: Tailwind CSS, with 75 million monthly downloads, saw an 80% revenue drop and laid off 75% of its staff because developers are using AI coding tools instead of consulting documentation. This ‘vibe coding’ reduces critical feedback and maintainer interaction, threatening open-source sustainability. Researchers and Frontend Masters suggest new revenue models, like corporate sponsorship or AI companies sharing revenue, are needed to prevent long-term degradation of the open-source ecosystem. <a href="https://app.daily.dev/feed-by-ids?id=3KjVRqoNX&amp;id=YRC8HFFhU&amp;id=aDodkq3hd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Laravel Boost v2.0 released with new skills system</strong>: Laravel Boost v2.0 introduces a ‘Skills’ system for developers to customize and extend their workflow, featuring skill synchronization, overrides, and an Artisan command to fetch skills directly from GitHub repositories. <a href="https://app.daily.dev/posts/xZZMD5bdo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Laravel Herd worktree automation with Claude Code</strong>: A new Claude Code skill automates git worktree setup for Laravel projects, streamlining environment configuration, dependency installation, Herd linking, and Vite setup, available open source via the Claude Code marketplace or GitHub. <a href="https://app.daily.dev/posts/9nZ5eRVBM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js 25.5.0 introduces SEA and security enhancements</strong>: Node.js 25.5.0 updates root certificates, adds Single Executable Application (SEA) generation with a new <code>--build-sea</code> flag, and activates SQLite defensive mode by default for enhanced security. <a href="https://app.daily.dev/posts/BrQRGrBKE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Docker sandboxes offer microVM isolation for AI coding agents</strong>: Docker Sandboxes now provide microVM-based isolation for autonomous AI coding agents like Claude Code and Gemini CLI, allowing them full access within their sandbox while preventing host system impact, currently available on macOS with Windows and Linux support planned. <a href="https://app.daily.dev/posts/6YdOupFK7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ChatGPT code execution environment expands language and package support</strong>: OpenAI’s ChatGPT code execution environment now supports Bash commands, multiple programming languages (JavaScript, Ruby, Perl, PHP, Go, Java, Swift, Kotlin, C, C++), and allows Python and JavaScript package installations via internal proxies, enhancing its utility for developers. <a href="https://app.daily.dev/posts/7V1v7MpYn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KDE Plasma desktop now compatible with Apple M3 via Fedora Asahi Remix</strong>: The KDE Plasma desktop environment now runs on Apple M3 chips, a significant milestone for Linux on Apple Silicon, achieved through the Fedora Asahi Remix project. <a href="https://app.daily.dev/posts/cxEiHEruW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DuckDB 1.4.4 LTS focuses on stability and performance</strong>: DuckDB 1.4.4 LTS delivers bugfixes, performance improvements, and security patches, addressing correctness issues in various join types and fixing multiple crash and segmentation fault issues, with no major new features. <a href="https://app.daily.dev/posts/4NWUdLPx5" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI will solve all math problems, industrialize cyber espionage, and transform the economy</strong>: According to the Import AI newsletter, Numina-Lean-Agent solved all Putnam 2025 math problems, Opus 4.5 and GPT-5.2 can autonomously generate zero-day exploits, and AI will be the most transformative technology ever. They even suggest allocating 5-10% of GDP to AI safety. Sounds like a perfectly balanced, non-sensationalized view of the future, definitely not designed to provoke urgency or sell newsletters. <a href="https://app.daily.dev/posts/QxbydGQJy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft’s ‘winapp’ tool: solving developer frustrations, or just adding another layer?</strong>: Microsoft has graced us with ‘winapp,’ a command-line tool to simplify Windows app development outside Visual Studio. It automates SDK management and packaging, supposedly making modern Windows APIs more accessible. Developers, however, remain skeptical, noting persistent frustrations with WinUI and the overall ecosystem. It’s almost as if adding another abstraction layer doesn’t magically fix fundamental complexity, but hey, at least it’s not Visual Studio, right? <a href="https://app.daily.dev/posts/xa7n8KICk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>npm and yarn: six zero-days are just ‘intentional design’</strong>: Six zero-day vulnerabilities, dubbed PackageGate, allow attackers to bypass worm attack defenses in npm and yarn. While pnpm, vlt, and Bun have patched these, npm insists these behaviors are ‘intentional design, not security flaws.’ So, executing malicious code by bypassing recommended protection features is a feature, not a bug. Good to know npm is prioritizing ‘design choices’ over, you know, security. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
