<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are affecting JavaScript package managers like npm and yarn, allowing attackers to bypass security controls designed to prevent worm attacks. While pnpm, vlt, and Bun have released patches, npm and yarn have not, with npm claiming the behavior is by design. Researcher Oren Yomtov strongly advises developers to migrate to patched package managers to avoid potential malicious payload delivery. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go team proposes generic methods</strong>: The Go team has proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability. This change, which would be fully backward-compatible, aims to enhance Go’s flexibility without impacting runtime performance. The proposal is currently in the discussion stage, requiring updates across the entire Go toolchain if accepted. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare launches serverless, post-quantum Matrix homeserver</strong>: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, leveraging a serverless architecture and post-quantum cryptography to protect against harvest-now-decrypt-later attacks. This aims to provide secure, end-to-end encrypted messaging with sub-50ms global latency and minimal operational overhead, costing less than $1 per month for idle servers. However, a Matrix developer has criticized the implementation for lacking critical security features and being incompatible with existing Matrix servers, suggesting it’s a low-effort release with potential cost issues for users. <a href="https://app.daily.dev/feed-by-ids?id=vURH9h7xw&amp;id=93HDTbjA4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Rust Foundation expands funding and outlines 2026-2028 strategy</strong>: The Rust Foundation raised $5.1 million in 2025, investing $2.7 million into project support, and has outlined a 2026-2028 strategy focusing on stable infrastructure, sustainable maintainer support, and responsible adoption growth. <a href="https://app.daily.dev/posts/y4jhOcrNg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Hybrid use of Rust and JavaScript/TypeScript in modern software architectures</strong>: Modern software architectures are increasingly combining Rust for performance-critical system-level components and JavaScript/TypeScript for rapid development and UI, often leveraging WebAssembly for seamless integration. <a href="https://app.daily.dev/posts/UAEJhL6mu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Teleport unveils agentic identity framework to secure AI agent access</strong>: Teleport launched a new Agentic Identity Framework that uses cryptographic authentication and zero-trust principles to secure AI agents, providing real-time visibility and enforcing least-privileged access to infrastructure. <a href="https://app.daily.dev/posts/CI1C8FH63" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CISA publishes federal guidance on post-quantum cryptography adoption</strong>: CISA has released guidance mapping NIST-standardized post-quantum cryptography algorithms to enterprise hardware and software, directing federal agencies to procure PQC-capable products where solutions are available. <a href="https://app.daily.dev/posts/5Lj7cpvbX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>MySQL community uncertainty amid Oracle layoffs and feature gaps</strong>: The MySQL community is expressing growing dissatisfaction due to Oracle’s layoffs impacting the MySQL team, decreased development velocity, and a lack of advanced features in the open-source Community Edition, leading to discussions about a potential community-supported fork. <a href="https://app.daily.dev/posts/u7JkpyQEs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>LinkedIn engineers address technical barriers in agentic RL training for GPT-OSS</strong>: LinkedIn’s engineering team successfully resolved several technical challenges, including log-probability mismatches and memory inefficiencies, to achieve stable agentic reinforcement learning training for the GPT-OSS model, validating its use for multi-step decision-making agents. <a href="https://app.daily.dev/posts/CAykziagK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vinted automates Vespa search maintenance using Temporal</strong>: Vinted replaced manual Bash scripts with Temporal for managing its Vespa search engine operations, enabling fault-tolerant orchestration, zero-impact upgrades, and self-service capabilities for engineers, significantly reducing operational toil. <a href="https://app.daily.dev/posts/psgDmdeNF" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI use accelerates decline of public knowledge platforms</strong>: Apparently, AI models are so good that developers are ditching Stack Overflow and Wikipedia, causing a ‘78% drop in traffic’ for the former. The article warns of ‘model collapse’ as AIs train on increasingly AI-generated content, leading to a future where our digital brains are just regurgitating each other’s hallucinations. Who needs human expertise when you can have an echo chamber of algorithms? <a href="https://app.daily.dev/posts/3Qlqmk7FI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ricursive Intelligence: the $4 billion startup that does… something with AI chips</strong>: Ricursive Intelligence, founded by ex-Google researchers, just snagged $300 million at a $4 billion valuation, two months after launch. Their grand plan? An AI system to design and improve AI chips. No products, no public statements from founders, just a lot of money and a vague promise of ‘self-improving AI systems.’ It’s almost like venture capitalists are just throwing money at anything with ‘AI’ and ‘chip’ in the same sentence. <a href="https://app.daily.dev/posts/pqGutcjN8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Agentic AI: the new buzzword for RAG</strong>: RAG (Retrieval-Augmented Generation) is apparently too passé, so now we have ‘context engineering,’ a ‘broader field’ that includes RAG and MCP. This rebranding is driven by ‘agentic AI systems’ that manage ‘the entire context state.’ Contextual AI even launched ‘Agent Composer’ for enterprises. It’s all very new and ‘hot,’ which usually means it’s the same old thing with a fresh coat of marketing paint and a hefty price tag. <a href="https://app.daily.dev/posts/tHZI0osnL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
