<h2>Must know</h2>
<ul>
<li><strong>GlassWorm malware hits Open VSX with silent dependency injection</strong>: A new supply-chain campaign is exploiting the Open VSX registry by publishing clean extensions that later update to include malicious hidden dependencies. Socket researchers identified 72 infected extensions impersonating tools like ESLint, Prettier, and Claude Code, which use VS Code’s automatic update mechanism to deliver the GlassWorm loader. This evolution highlights a critical gap in IDE extension security where runtime behavior bypasses initial static analysis. <a href="https://app.daily.dev/feed-by-ids?id=yKzLDg3bN&amp;id=7qAB3XlzU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Graph API credentials exposed in public Postman workspaces</strong>: Security researchers discovered live OAuth client credentials in public Postman workspaces, granting unauthorized access to 59,000 user records and Teams messages. Because the Graph API acts as a direct intrusion vector, these leaks bypass traditional MFA and endpoint controls entirely. Organizations are advised to immediately audit non-interactive sign-in logs and restrict over-provisioned application permissions that often go unmonitored. <a href="https://app.daily.dev/posts/RDgIqyTOp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Triple active multi cloud architecture survives major GCP outage</strong>: UK payments platform Form3 successfully maintained operations during a significant Google Cloud outage using a custom architecture spanning AWS, GCP, and Azure. As reported by InfoQ, the system utilizes NATS JetStream for cross-cloud messaging and CockroachDB for distributed storage, though the team noted that the complexity is only justifiable for high-stakes regulatory compliance. This implementation serves as a rare production-proven blueprint for avoiding cloud provider concentration risk. <a href="https://app.daily.dev/posts/QM7no5aLQ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Temporal API reaches Stage 4 for ECMAScript 2026</strong>: The long-awaited immutable date/time API is officially finalized, bringing predictable arithmetic and built-in time zone support to native JavaScript. <a href="https://app.daily.dev/posts/WsjtjDMl5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Avalonia 12.0 Preview drops legacy .NET support</strong>: The new release mandates .NET 8, introduces a TextOptions API for letter spacing, and moves the VS Code extension to a paid licensing model for large firms. <a href="https://app.daily.dev/feed-by-ids?id=I5gILgxNy&amp;id=RDfVaJWvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WordPress 7.0 adds native custom CSS and text indent</strong>: The core update introduces block-level custom CSS with scoped hashing and first-class support for typographic line indentation in the Paragraph block. <a href="https://app.daily.dev/feed-by-ids?id=3xregKloE&amp;id=MwVot188R" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Z80 Sans font disassembles opcodes via OpenType</strong>: A novel technical project uses OpenType substitution and positioning tables to turn a font into a functional Z80 assembly disassembler. <a href="https://app.daily.dev/posts/NHBet6OKX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Electron 41 integrates ASAR integrity for macOS</strong>: The latest version adds tamper detection at app launch and improves Wayland support for frameless windows on Linux. <a href="https://app.daily.dev/posts/5DiYYKmIR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenJarvis framework targets on device AI efficiency</strong>: Developed at Stanford, this local-first framework treats energy and FLOPs as primary constraints for running agents on personal hardware. <a href="https://app.daily.dev/posts/UjBsvfRxN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>JHipster 9.0 aligns with Spring Boot 4.0</strong>: The GA release brings support for JDK 21+, React 19, and Angular 21 to the popular application generator. <a href="https://app.daily.dev/posts/dmuzOhIju" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Amazon blames users after AI wipes production environments</strong>: After internal AI tools deleted production environments and killed 99% of North American orders in a single day, Amazon’s brilliant solution was to blame ‘user error’ and mandate senior sign-offs. This comes right after laying off 16,000 experienced engineers, proving that ‘AI-driven efficiency’ is just corporate speak for ‘we broke the build and don’t have enough humans left to fix it.’ Using AI to supervise the AI that caused the outage is the ultimate peak of this recursive nightmare. <a href="https://app.daily.dev/posts/Nu2d4YyjL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The 30 minute app myth meets 100 hours of vibe coding</strong>: While influencers claim you can ‘vibe-code’ a production app in a lunch break, real-world post-mortems show it still takes 100+ hours to handle UI edge cases, AWS infra, and security. ‘Vibe-coding’ is essentially just high-speed technical debt accumulation where you trade understanding your code for a faster feedback loop of errors. If you don’t know why the LLM’s code works, you’re just one hallucination away from a 13-hour recovery window. <a href="https://app.daily.dev/feed-by-ids?id=8mHkiEYNC&amp;id=fGgNFxUDn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>IPv4x is the network protocol equivalent of fan fiction</strong>: A new ‘thought experiment’ proposes IPv4x, a 128-bit extension to IPv4 that supposedly fixes everything without the ‘pain’ of IPv6. It’s a classic case of ‘if only we did this 20 years ago’ nostalgia that ignores the reality of global routing tables and hardware compatibility. Proposing a hypothetical protocol in 2026 is like designing a better steam engine while everyone else is already arguing about the charging standards for electric cars. <a href="https://app.daily.dev/posts/MgAj9qPB2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
