<h2>Must know</h2>
<ul>
<li><strong>GlassWorm malware hits Open VSX and GitHub</strong>: A sophisticated supply-chain campaign is exploiting the Open VSX registry and GitHub by publishing clean extensions that later pull malicious dependencies. Socket researchers identified over 72 malicious extensions impersonating tools like ESLint, Prettier, and Claude Code, which use invisible Unicode characters to hide payloads. These attacks bypass visual audits and rely on VS Code’s automatic dependency installation to deliver the GlassWorm loader. <a href="https://app.daily.dev/feed-by-ids?id=yKzLD%3Ag3bN&amp;id=7qAB3XlzU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Temporal API reaches Stage 4 in ECMAScript 2026</strong>: The long-awaited Temporal API has finally advanced to Stage 4, officially replacing the broken global Date object in the JavaScript specification. According to Socket, this introduces immutable date/time types with built-in timezone support and predictable arithmetic, solving a decade of developer frustration. Browser support is already live in Firefox and Chromium, with TypeScript 6.0 providing the necessary type definitions. <a href="https://app.daily.dev/posts/WsjtjDMl5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vite 8 switches to Rust based Rolldown bundler</strong>: Vite 8.0 has officially swapped out Rollup for Rolldown, a new bundler written in Rust that claims to be 10 to 30 times faster. The Register reports this move consolidates the build pipeline into a single native-code toolchain, significantly reducing dev server startup times. This follows the industry trend of replacing JavaScript-based tooling with high-performance native alternatives like Turbopack and Rspack. <a href="https://app.daily.dev/posts/mksK39aMS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Bcachefs 1.37 stabilizes erasure coding and RAID functionality</strong>: The latest release completes core data redundancy features and improves recovery from hardware with bad flush support. <a href="https://app.daily.dev/posts/Nvzov0IYi" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Avalonia UI 12.0 drops legacy .NET support for performance</strong>: The preview release mandates .NET 8, adds Mac Catalyst support, and introduces a paid, closed-source VS Code extension. <a href="https://app.daily.dev/feed-by-ids?id=I5gILgxNy&amp;id=RDfVaJWvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS ships Lambda Durable Functions and S3 Vectors</strong>: New non-AI updates include multi-step Lambda workflows without Step Functions and native vector storage in S3. <a href="https://app.daily.dev/posts/RpUsF4Co4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WordPress 7.0 adds native custom CSS and dimension presets</strong>: The update introduces per-block custom CSS attributes and first-class width/height supports via block.json. <a href="https://app.daily.dev/feed-by-ids?id=3xregKloE&amp;id=L9qEHhgSw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ConfigClarity offers browser based DevOps audit tools</strong>: A suite of zero-dependency HTML tools for auditing Docker Compose, SSL, and firewalls without sending data to a backend. <a href="https://app.daily.dev/posts/0XeW2Rx4B" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Deno and Bun practical comparison for Node developers</strong>: Deno is recommended for security-sandboxed workloads, while Bun is positioned as the faster toolchain for local development. <a href="https://app.daily.dev/posts/Sg2hmfheP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Z80 Sans font disassembles opcodes via OpenType</strong>: A novel project uses OpenType substitution tables to turn hex opcodes into assembly mnemonics purely through font rendering. <a href="https://app.daily.dev/posts/NHBet6OKX" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Amazon blames users for AI induced outages</strong>: After AI tools like Amazon Q and Kuro wiped production environments and killed millions of orders, Amazon’s brilliant solution was to blame ‘user error’ and mandate senior sign-offs. This is peak corporate gaslighting, considering they just laid off 16,000 engineers and are now asking the survivors to babysit the very bots that replaced their colleagues. It turns out next-token predictors don’t actually understand what ‘delete production’ means. <a href="https://app.daily.dev/posts/Nu2d4YyjL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The 30 minute app myth debunked by vibe coding</strong>: While influencers claim you can build a startup in a lunch break, one PM spent 100 hours ‘vibe-coding’ a simple mini-app to get it production-ready. The reality is that AI is great at the first 10%, but the remaining 90%—infrastructure, security, and edge cases—still requires the engineering soul that LLMs lack. ‘Vibe-coding’ is just a fancy new name for ‘debugging code you didn’t write.’ <a href="https://app.daily.dev/posts/8mHkiEYNC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>IPv4x is the network protocol that shouldn’t exist</strong>: A new ‘thought experiment’ proposes IPv4x, a 128-bit extension to IPv4 that supposedly fixes everything without the ‘pain’ of IPv6. It’s a classic case of ‘backward-compatibility’ worship that ignores the massive technical debt of updating every DNS and DHCP server on the planet. We don’t need a 96-bit sub-address hack; we need people to stop pretending NAT is a feature. <a href="https://app.daily.dev/posts/MgAj9qPB2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
