<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are affecting JavaScript package managers like npm and yarn, allowing attackers to bypass security controls and deliver malicious payloads. While pnpm, vlt, and Bun have released patches, npm claims the behavior is an intentional design, not a flaw. Researcher Oren Yomtov strongly advises developers to migrate to patched package managers, highlighting a significant security risk for the JavaScript ecosystem. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day forces emergency patch</strong>: Microsoft released an emergency out-of-band patch for a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office, actively exploited in the wild. The flaw, a security feature bypass, allows attackers to use malicious Office files to circumvent protections against legacy COM and OLE components. While newer Office versions are patched, Office 2016 and 2019 users must rely on manual registry workarounds, as reported by Microsoft and CISA. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare launches serverless post-quantum Matrix homeserver</strong>: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, leveraging a serverless architecture and post-quantum cryptography (X25519MLKEM768) by default. This aims to protect data from ‘harvest-now-decrypt-later’ attacks and offers end-to-end encrypted messaging with sub-50ms global latency, costing less than $1 per month for idle servers. However, a Matrix developer criticized the implementation for lacking critical security features and being incompatible with existing Matrix servers, as noted by Cloudflare’s own documentation. <a href="https://app.daily.dev/posts/vURH9h7xw" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Rust Foundation expands funding and outlines 2026-2028 strategy</strong>: The Rust Foundation raised $5.1 million in 2025, investing $2.7 million into project support, and outlined a 2026-2028 strategy focusing on stable infrastructure, sustainable maintainer support, and responsible adoption growth. <a href="https://app.daily.dev/posts/y4jhOcrNg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go language team proposes generic methods</strong>: The Go team has proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability, while maintaining backward compatibility. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KPHP open-source PHP compiler by <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a></strong>: <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a> has open-sourced KPHP, a PHP compiler that transpiles a restricted subset of PHP to C++ for native binaries, offering 3-10x speed improvements over standard PHP but lacking support for dynamic features. <a href="https://app.daily.dev/posts/801wep0xd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Minigalaxy 1.4.1 Linux GOG client released</strong>: Minigalaxy 1.4.1, a lightweight Linux client for GOG, has been released with improved installation progress, enhanced error handling, and a fix for CJK character handling in library paths. <a href="https://app.daily.dev/posts/KCJKtM7zU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CISA publishes federal guidance on post-quantum cryptography adoption</strong>: CISA has released guidance mapping NIST-standardized post-quantum cryptography algorithms to enterprise hardware and software, urging federal agencies to procure PQC-capable products where solutions are available. <a href="https://app.daily.dev/posts/5Lj7cpvbX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS Network Firewall adds GenAI traffic controls</strong>: AWS Network Firewall now supports web category-based filtering for generative AI application traffic, allowing security teams to block or restrict access to GenAI services at the network level. <a href="https://app.daily.dev/posts/AdbvgaiZY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Picolibc 1.8.11 release brings RISC-V and Hexagon updates</strong>: Picolibc 1.8.11 has been released, bringing improvements for RISC-V architecture, support for Qualcomm Hexagon processors, and enhanced POSIX compliance for embedded C standard library development. <a href="https://app.daily.dev/posts/XNeTbsf3f" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: the new ‘team member’ that needs constant babysitting</strong>: Apparently, AI agents are ‘quietly transforming the enterprise’ and developers’ roles are shifting to ‘product architects.’ But don’t get too excited, because these ‘coworkers’ still need human oversight, governance, and accountability frameworks to prevent ‘agent sprawl’ and ‘erratic agent-driven outcomes.’ So, basically, we’re just managing more complex, digital interns now, as noted by Temporal and other ‘experts.’ <a href="https://app.daily.dev/feed-by-ids?id=b2fEANN64&amp;id=yBxtGCVqr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ricursive Intelligence: the $4 billion startup that hasn’t done anything yet</strong>: Ricursive Intelligence, founded by former Google researchers, just raised $300 million at a $4 billion valuation, two months after launch. Their big idea? An AI system to design and improve AI chips. No products, no public releases, just a lot of hype and a comparison to other startups with ‘similar objectives.’ It’s almost like venture capitalists are just throwing money at anything with ‘AI’ in the name, as reported by various sources. <a href="https://app.daily.dev/posts/pqGutcjN8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI ethics: all talk, no trousers</strong>: Despite a ‘proliferation’ of AI ethics frameworks, vulnerable groups are still getting screwed, and major tech companies are busy lobbying to water down any actual regulations. Turns out, ‘human-centric’ AI and ‘responsible innovation’ are just buzzwords while ethics teams get dismantled and algorithmic systems cause real harm, like in the Dutch childcare fraud scandal. Who could have seen that coming? <a href="https://app.daily.dev/posts/lKscHPRX8" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
