<h2>Must know</h2>
<ul>
<li><strong>Trivy supply chain attack compromises GitHub Actions</strong>: Aqua Security’s Trivy vulnerability scanner suffered a major supply chain compromise where attackers force-pushed malicious payloads to 75 out of 76 version tags in the official repository. The malware targets CI/CD pipelines to harvest SSH keys, cloud credentials for AWS, GCP, and Azure, and Kubernetes tokens from runner memory. Security researchers at Socket and the Apache Software Foundation advise immediate rotation of all pipeline secrets for any organization that ran the affected actions recently. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft rolls back Copilot bloat in Windows 11</strong>: Responding to community feedback and performance concerns, Microsoft is removing Copilot AI entry points from core Windows 11 apps like Notepad, Snipping Tool, and File Explorer. The company is pivoting toward a quality-focused roadmap centered on performance and reliability, including WinUI3 migrations for lower latency and better memory efficiency. This shift follows a Pew Research study indicating that half of U.S. adults are more concerned than excited about the current state of AI integration. <a href="https://app.daily.dev/posts/R3I8JkvR5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>International task force dismantles 31 Tbps IoT botnets</strong>: The US Department of Justice, alongside German and Canadian authorities, disrupted four massive IoT botnets—Aisuru, KimWolf, JackSkid, and Mossad—responsible for record-breaking DDoS attacks. The operation seized command-and-control infrastructure that controlled over three million compromised devices, including routers and IP cameras. While the infrastructure was seized, Krebs on Security notes that millions of unpatched devices remain online and vulnerable to future exploitation. <a href="https://app.daily.dev/posts/Z5D5TjMr3" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Next.js 16.2 optimizes server component deserialization for 400 percent faster startup</strong>: The release replaces JSON.parse reviver callbacks with pure JavaScript recursive walks to significantly boost rendering speed. <a href="https://app.daily.dev/posts/pLH5NluEB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google introduces Sashiko AI code reviewer for the Linux kernel</strong>: The Rust-based tool found 53 percent of bugs in upstream testing that were previously missed by human maintainers. <a href="https://app.daily.dev/posts/j5mdnOwUC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks DASF 3.0 identifies 35 new security risks for AI agents</strong>: The framework highlights the lethal trifecta of sensitive data access, autonomous action, and lack of human oversight. <a href="https://app.daily.dev/posts/1prgvqWuk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>State of JavaScript 2025 shows TypeScript used by 40 percent of developers exclusively</strong>: Vite has officially overtaken Webpack in satisfaction, while Cursor usage more than doubled in the last year. <a href="https://app.daily.dev/posts/rcBrZOPNH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft unifies SQL portfolio with Fabric Database Hub</strong>: The new management plane provides a converged platform for Azure SQL, Cosmos DB, and PostgreSQL with agent-assisted observability. <a href="https://app.daily.dev/posts/9lGZhe2Qp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Heroku CLI v11 completes full migration to ESM and Node 22</strong>: The architectural overhaul uses oclif v4 for faster execution through improved tree-shaking and manifest caching. <a href="https://app.daily.dev/posts/2swWgPS9c" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flash-KMeans achieves 17x speedup on NVIDIA H200 GPUs</strong>: The implementation optimizes IO overhead and atomic write contention to outperform FAISS and cuML baselines. <a href="https://app.daily.dev/posts/fGQv2cjZG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The corporate mandate to use AI or lose your job</strong>: Amazon and Meta are now reportedly tracking AI tool usage in weekly performance reviews, because nothing says ‘innovation’ like forcing developers to use tools that Anthropic’s own research says reduce skill retention by 17 percent. We’ve reached the peak of the hype cycle where management values the ‘vibe’ of using AI over the actual quality of the output. It’s a bold strategy to mandate tools that studies show make experienced engineers 19 percent slower while introducing security flaws at a 45 percent clip. <a href="https://app.daily.dev/feed-by-ids?id=9KgLLeZB1&amp;id=IusRVfD2s&amp;id=W9FropxM1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The 100 percent AI driven project fantasy</strong>: Proponents are claiming AI agents can generate 600 tasks in 3 hours, conveniently ignoring that someone actually has to verify if those tasks aren’t total hallucinations. Alibaba’s study of 18 agents found that 75 percent of codebases broke within eight months of autonomous operation, proving that ‘shipping fast’ is just a euphemism for ‘generating technical debt at scale.’ We are effectively replacing engineering judgment with a compound probability nightmare where a 10-step task has an 80 percent failure rate. <a href="https://app.daily.dev/feed-by-ids?id=IusRVfD2s&amp;id=ypIaCKz6j" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
