<h2>Must know</h2>
<ul>
<li><strong>Node.js security update for OpenSSL vulnerabilities</strong>: Node.js has identified three low to moderate severity vulnerabilities related to PFX certificate processing in OpenSSL, affecting TLS configurations. While these impact all Node.js branches, the attack surface is limited, and fixes will be rolled out in regular releases, not dedicated security patches. This is a good reminder to keep your Node.js environments updated, as reported by Node Weekly. <a href="https://app.daily.dev/feed-by-ids?id=jITntLdtr&amp;id=cxcf5c0i9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubernetes RCE flaw persists in older versions</strong>: Edera Advisory found a critical design flaw in Kubernetes that allows remote code execution in any container via <code>nodes/proxy GET</code> permissions. While Kubernetes 1.36 will remove this problematic permission, many production clusters won’t update for months or years. This means you need to scan for RCE attempts and implement fine-grained authorization controls, as this isn’t even classified as a CVE. <a href="https://app.daily.dev/posts/phMyeDnVg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft’s hybrid AI chip strategy</strong>: Microsoft has deployed its Maia 200 AI inference chip in data centers, claiming superior performance over competitors. However, CEO Satya Nadella confirmed they’ll continue buying AI chips from Nvidia and AMD, indicating a diversified supply chain strategy. This suggests that even the big players aren’t putting all their eggs in one silicon basket, as reported by Satya Nadella. <a href="https://app.daily.dev/posts/kN85HgrLU" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>New npm infostealer targets crypto and cloud credentials</strong>: A malicious npm package, <code>ansi-universal-ui</code>, has been found deploying the G_Wagon infostealer, which targets crypto wallets, browser credentials, and cloud provider keys, emphasizing the need for vigilance in dependency management. <a href="https://app.daily.dev/posts/2hgomnTp3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Framer boosts performance with Rolldown bundler</strong>: Framer migrated to the Rolldown bundler, achieving significant performance gains including a 41% improvement in Largest Contentful Paint and a 36% reduction in JavaScript size, showcasing the impact of optimized bundling. <a href="https://app.daily.dev/posts/P0rwqYL8o" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js 25.5 simplifies single executable apps</strong>: Node.js 25.5 introduces a new <code>--build-sea</code> flag, simplifying the creation of single executable applications by eliminating the need for external tooling. <a href="https://app.daily.dev/posts/cxcf5c0i9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Type-safe HTTP/2 client for Node.js</strong>: Vorr is a new minimal, type-safe HTTP/2 client library for Node.js built on the native <code>http2</code> module, offering zero external dependencies and OpenTelemetry metrics support. <a href="https://app.daily.dev/posts/X7bksHa2Y" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Cloud BigQuery gets conversational analytics</strong>: Google Cloud has launched Conversational Analytics in BigQuery, an AI-powered agent that allows natural language data analysis, eliminating the need for SQL knowledge by leveraging Gemini models. <a href="https://app.daily.dev/posts/2YKMeABdR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Apiiro launches AI code security agent</strong>: Apiiro introduced Guardian Agent, an AI security tool designed to prevent AI coding agents from generating vulnerable code by rewriting developer prompts into secure ones in real-time within IDEs. <a href="https://app.daily.dev/posts/5AaMXyHJd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Meta’s escalating AI infrastructure investment</strong>: Meta plans to invest $115-135 billion in AI infrastructure in 2026, nearly doubling its previous year’s investment, to support its Superintelligence Labs and integrate large language models across its platforms. <a href="https://app.daily.dev/posts/JHGPGk0MW" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Musk’s trillion-dollar super-company fantasy</strong>: Elon Musk’s companies—SpaceX, xAI, and possibly Tesla—are reportedly in ‘early merger discussions’ to form a trillion-dollar super-company. The rationale? Space-based AI data centers to ‘reduce AI model training costs.’ Because, clearly, the biggest problem with AI is not enough rockets and satellites. This sounds less like a business strategy and more like a fever dream fueled by too much Starlink, as reported by various sources. <a href="https://app.daily.dev/posts/wMYF638eZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google DeepMind’s ‘Project Genie’ and the gaming industry’s ‘concerns’</strong>: Google DeepMind launched ‘Project Genie,’ an AI world generator that creates ‘infinite, interactive environments.’ Google frames it as a step toward AGI and a game prototyping tool. Meanwhile, 52% of game developers now believe AI negatively impacts their field, up from 30% last year, and 33% have been laid off. Funny how ‘innovation’ often translates to ‘job displacement’ for everyone else, isn’t it? <a href="https://app.daily.dev/posts/iit38VC43" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Meta’s Reality Labs: Peak losses or just peak delusion?</strong>: Meta’s Reality Labs reported $19.2 billion in losses for FY25, bringing its total losses to $83.6 billion since 2020. Mark Zuckerberg, ever the optimist, expects FY25 to be ‘peak losses’ as they pivot to ‘AI-integrated wearables.’ So, after burning tens of billions on a metaverse nobody wanted, the solution is to strap AI to our faces. I’m sure this time it’ll be different. <a href="https://app.daily.dev/posts/ALCffHVkc" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
