<h2>Must know</h2>
<ul>
<li><strong>Open source is getting screwed by AI coding tools</strong>: AI coding tools are causing a major crisis for open-source projects. Tailwind CSS, a widely used framework, saw an 80% revenue drop and laid off 75% of its staff because developers are using AI tools instead of documentation, according to Frontend Masters Blog. This ‘vibe coding’ reduces engagement with maintainers and threatens the sustainability of critical open-source infrastructure. Researchers are proposing revenue-sharing models for AI companies that profit from these open-source libraries, drawing parallels to how Spotify compensates artists. <a href="https://app.daily.dev/feed-by-ids?id=3KjVRqoNX&amp;id=YRC8HFFhU&amp;id=aDodkq3hd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubernetes RBAC vulnerability allows cluster-wide remote code execution</strong>: A critical authorization bypass vulnerability in Kubernetes Role-Based Access Control (RBAC) allows remote code execution in any Pod with <code>nodes/proxy GET</code> permission. This flaw, which affects 69 Helm charts including those for Prometheus and Grafana, stems from Kubelet authorizing WebSocket <code>/exec</code> requests based on read-only permissions. The Kubernetes Security Team acknowledged the behavior but deemed it ‘working as intended,’ recommending an architectural change that hasn’t been implemented, leaving many clusters at risk. <a href="https://app.daily.dev/feed-by-ids?id=YKjgFzDSZ&amp;id=wlbhCOZ7B" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>npm and yarn have zero-day vulnerabilities, maintainers say it’s ‘intentional design’</strong>: Six zero-day vulnerabilities, dubbed PackageGate, exist in npm and yarn, allowing attackers to bypass defenses against worm attacks. While pnpm, vlt, and Bun have patched these issues, npm and yarn have not, with npm stating the vulnerable behaviors are part of their ‘intentional design.’ This means malicious code can be executed by bypassing recommended protection features, leaving millions of JavaScript projects exposed. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Microsoft launches new AI inference chip and open SDK</strong>: Microsoft has unveiled the Maia 200 chip for AI inference, claiming it outperforms Amazon’s Trainium3 by three times and Google’s TPU v7 in FP8 performance, and is making its SDK openly available to developers and researchers. <a href="https://app.daily.dev/posts/fDSp3OUaH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Docker sandboxes microVM isolation for AI coding agents</strong>: Docker Sandboxes now offers microVM-based isolation for autonomous AI coding agents like Claude Code and Gemini CLI, allowing them to operate securely with full system access within their own dedicated, hypervisor-isolated environments on macOS, with Windows and Linux support planned. <a href="https://app.daily.dev/posts/6YdOupFK7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ChatGPT code execution environment gets major upgrades</strong>: OpenAI’s ChatGPT code execution environment now supports Bash commands, multiple new programming languages (JavaScript, Ruby, Go, Java, Swift, C, C++), and allows users to install Python and JavaScript packages via internal proxies, significantly expanding its utility for developers. <a href="https://app.daily.dev/posts/7V1v7MpYn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go team proposes generic methods for the language</strong>: The Go team is proposing to add generic methods to the language, allowing type parameters on concrete methods to improve code clarity and readability, while maintaining full backward compatibility. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>React Server Components hit with denial-of-service vulnerabilities</strong>: Multiple denial-of-service vulnerabilities (CVE-2026-23864) have been identified in React Server Components (versions 19.0.x-19.2.x), allowing specially crafted HTTP requests to cause server crashes or excessive CPU usage, affecting Next.js and other tools. <a href="https://app.daily.dev/posts/igYAcLEa7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KDE Plasma desktop now compatible with Apple M3 via Fedora Asahi Remix</strong>: The KDE Plasma desktop environment now officially runs on Apple M3 chips, a significant milestone for Linux on Apple Silicon, achieved through the Fedora Asahi Remix project. <a href="https://app.daily.dev/posts/cxEiHEruW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DuckDB 1.4.4 LTS release focuses on stability and performance</strong>: DuckDB has released version 1.4.4 LTS, an update focused on bugfixes, performance improvements, and security patches, addressing correctness issues in joins and streaming unions, and fixing multiple crash-related problems. <a href="https://app.daily.dev/posts/4NWUdLPx5" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI will replace software engineers, again</strong>: Apparently, AI is <em>still</em> going to eliminate software engineering jobs, according to Anthropic and NVIDIA executives, who’ve been making these predictions since 2023. At Davos, tech CEOs repeated similar timelines, claiming developers will be replaced in 6-12 months. Yet, there’s no concrete evidence of major layoffs due to AI, just a recurring narrative that conveniently ignores AI’s limitations to probabilistic recombination of existing data. It’s almost like they’re trying to generate hype, or maybe just clickbait, as one article points out. <a href="https://app.daily.dev/feed-by-ids?id=1iSdibthb&amp;id=7WOFbf92G&amp;id=9yXNAQlaN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-driven ‘fast fashion’ in software: because who needs quality?</strong>: The software industry is now being compared to ‘fast fashion,’ with AI-generated code mass-produced for speed over quality. Large tech companies are reportedly using AI agents to churn out ‘mediocre, narrow, and rote engineering,’ leading to buggy, unreliable tools and unmaintainable codebases. So, while your AI coding assistant might be fast, it’s apparently just helping you create digital landfill. But hey, at least it’s fast! <a href="https://app.daily.dev/feed-by-ids?id=dABjwqV7N&amp;id=vz4g5mSDD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google’s AI overviews prefer YouTube over actual medical experts</strong>: A German study found that Google’s AI Overviews cited YouTube more often than established medical websites for health queries, raising concerns about content visibility and popularity trumping actual medical authority. Google, of course, claims its AI prioritizes ‘high-quality content from credible health sources,’ even if those sources are just random YouTubers. Because when it comes to your health, who needs doctors when you have influencers? <a href="https://app.daily.dev/posts/ZEb80nG1f" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
