<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are affecting npm and yarn, allowing attackers to bypass security controls designed to prevent worm attacks. While pnpm, vlt, and Bun have released patches, npm and yarn have not, with npm claiming the behavior is ‘by design.’ Researcher Oren Yomtov strongly advises developers to migrate to patched package managers, as reported by multiple sources. This is a critical security alert for JavaScript developers. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day forces emergency patch</strong>: Microsoft released an emergency out-of-band patch for a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office, actively exploited in the wild. The flaw, a security feature bypass with a CVSS score of 7.8, allows attackers to use malicious Office files to bypass protections against legacy COM and OLE components. While newer Office versions are patched, Office 2016 and 2019 users must rely on manual registry workarounds, as reported by Microsoft and CISA. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents reshape developer roles and enterprise operations</strong>: The rise of AI agents is shifting developer roles from coding to product architecture and outcome engineering, as AI automates much of the execution. Enterprises are integrating AI agents as core system features, creating new infrastructure needs for orchestration and fault tolerance. The main challenge is leadership in agent governance to prevent ‘agent sprawl’ and ensure accountability, according to articles discussing the ‘agentic stack’ and enterprise transformation. <a href="https://app.daily.dev/feed-by-ids?id=b2fEANN64&amp;id=yBxtGCVqr" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Teleport unveils agentic identity framework for AI security</strong>: Teleport launched a new Agentic Identity Framework that applies cryptographic authentication to AI agents, moving beyond static credentials to reduce risks like prompt injection and unauthorized access. <a href="https://app.daily.dev/posts/CI1C8FH63" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare launches serverless post-quantum Matrix homeserver</strong>: Cloudflare ported a full Matrix homeserver, Tuwunel, to its Workers platform, using a serverless architecture and X25519MLKEM768 post-quantum cryptography to protect against harvest-now-decrypt-later attacks. <a href="https://app.daily.dev/posts/vURH9h7xw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents’ impact on Swift code quality</strong>: While AI coding agents can quickly generate functional code, they often violate language idioms, introduce unnecessary complexity, and create subtle semantic errors, requiring consistent human expert review to maintain codebase quality in Swift projects. <a href="https://app.daily.dev/feed-by-ids?id=uilUGnhp4&amp;id=uilUGnhp4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go language team proposes generic methods</strong>: The Go team has proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability, with full backward compatibility. <a href="https://app.daily.dev/feed-by-ids?id=W8OOKuC86&amp;id=W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KPHP open-source PHP compiler by <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a></strong>: <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a>’s KPHP is an open-source PHP compiler that transpiles a restricted subset of PHP to C++ for native binaries, offering 3-10x speed improvements over standard PHP with compile-time type inference. <a href="https://app.daily.dev/feed-by-ids?id=801wep0xd&amp;id=801wep0xd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Hybrid use of Rust and JavaScript/TypeScript in modern architectures</strong>: Modern software architectures increasingly combine JavaScript/TypeScript for rapid development and UI with Rust for performance-critical, memory-safe system-level components, often integrated via WebAssembly. <a href="https://app.daily.dev/feed-by-ids?id=UAEJhL6mu&amp;id=UAEJhL6mu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Streaming JSON for responsive AI APIs</strong>: Streaming JSON is gaining relevance for AI APIs to deliver word-by-word output, and a new JavaScript technique ensures progressive delivery while maintaining JSON validity. <a href="https://app.daily.dev/feed-by-ids?id=yyfhP6ohw&amp;id=yyfhP6ohw" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Cloudflare’s Matrix homeserver: a masterclass in ‘how not to’</strong>: Cloudflare, in its infinite wisdom, announced a Matrix homeserver implementation on its Workers platform. A Matrix developer, however, quickly pointed out it lacks basic security features like authorization, is riddled with TODOs, and would cost more than a standard VPS. Apparently, ‘serverless’ now means ‘less secure, less functional, and more expensive,’ as detailed in a scathing critique. <a href="https://app.daily.dev/posts/93HDTbjA4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI ethics: all talk, no trousers</strong>: Despite a ‘proliferation’ of AI ethics frameworks, major tech companies are busy lobbying to dilute regulations and dismantling their own ethics teams. Turns out, ‘human-centric’ AI is just a nice phrase until it cuts into profits, leaving vulnerable groups unprotected, as evidenced by algorithmic welfare scandals in the Netherlands and Australia. Who knew that self-regulation by corporations wasn’t a foolproof plan? <a href="https://app.daily.dev/posts/lKscHPRX8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Context engineering: new name, same RAG hype</strong>: RAG (Retrieval-Augmented Generation) is apparently too passé, so now we’re calling it ‘context engineering’ because, you know, ‘agentic AI systems’ manage ‘context state.’ This rebranding, spearheaded by Contextual AI’s ‘Agent Composer,’ promises to simplify compliance and governance. It’s almost as if they’re trying to make old wine in new bottles sound revolutionary, hoping you’ll forget it’s still just about feeding data to an LLM, as noted by the ever-optimistic vendor. <a href="https://app.daily.dev/posts/tHZI0osnL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
