<h2>Must know</h2>
<ul>
<li><strong>Interlock ransomware hits Cisco via zero day</strong>: The Interlock ransomware group exploited a critical zero-day vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center for 38 days before a patch was released. Amazon’s MadPot honeypot network uncovered the attack chain, which allows remote code execution via deserialization and carries a maximum CVSS score of 10. Security teams are urged by Cisco and Amazon researchers to patch immediately to prevent further exploitation by this RaaS group. <a href="https://app.daily.dev/posts/kS1FWAP6y" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>FBI seizes Handala sites after Stryker wipeout</strong>: Federal authorities seized the infrastructure of the pro-Iranian group Handala following a devastating cyberattack on medical tech giant Stryker. The group reportedly used compromised Microsoft Intune administrator accounts to wipe tens of thousands of employee devices, leading CISA to issue an urgent alert on hardening Intune with dual-administrator approvals. While the websites are down, analysts warned via FBI reports that the group may resume operations through IRGC-linked channels. <a href="https://app.daily.dev/posts/N8kFe3mft" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor launches Composer 2 with context compaction</strong>: Cursor has released its third in-house model, Composer 2, which introduces a ‘self-summarization’ reinforcement learning technique to manage long-horizon coding tasks. The model reportedly outperforms Claude 4.6 on Terminal-Bench 2.0 by compressing its context window to 1,000 tokens when limits are reached, reducing errors by 50% compared to traditional sliding windows. Cursor claims this new architecture allows for hundreds of sequential actions while remaining significantly cheaper than Anthropic’s flagship models. <a href="https://app.daily.dev/posts/mIKxoNmwG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Nextjs 16.2 replaces JSON parsing with recursive walks for speed</strong>: The release claims up to 60% faster HTML rendering by swapping JSON.parse revivers for pure JavaScript recursive walks during server component deserialization. <a href="https://app.daily.dev/posts/pLH5NluEB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Java 26 arrives with G1 GC overhead reductions</strong>: The new non-LTS release includes JEP 522 for lower synchronization overhead and JEP 516 for ZGC-compatible ahead-of-time object caching. <a href="https://app.daily.dev/posts/QPwbRCIfz" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Meilisearch patches LMDB for 3x faster vector inserts</strong>: By implementing an atomically reference-counted system in C11, the team enabled nested read transactions on uncommitted writes to eliminate full database scans. <a href="https://app.daily.dev/posts/cGS7yNBCA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft updates DXGKRNL Linux driver after four year silence</strong>: The v4 patches add compute-only adapter support for AI/ML accelerators in WSL2, though upstream kernel acceptance remains uncertain due to closed-source dependencies. <a href="https://app.daily.dev/posts/vI0DBkoPf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Heroku CLI v11 completes full ESM migration</strong>: The architectural overhaul moves to oclif v4 and Node.js 22, delivering faster execution through improved tree-shaking and a new semantic color system. <a href="https://app.daily.dev/feed-by-ids?id=2swWgPS9c&amp;id=rnRadhI60" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Mystral Native.js runs WebGPU apps without a browser</strong>: This early-alpha runtime uses V8 and SDL3 to execute JavaScript games natively on desktop with support for Three.js and PixiJS. <a href="https://app.daily.dev/posts/YUabTxSP2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PowerShell 7.6 enters LTS on NET 10</strong>: The new long-term support version promotes several experimental engine features to mainstream and adds new parameters to core cmdlets. <a href="https://app.daily.dev/posts/TIHXwNFB4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Google invents vibe coding to hide the prompts</strong>: Google AI Studio is now pushing ‘vibe coding,’ a marketing term for generating full-stack apps from natural language that sounds suspiciously like ‘we hope the LLM doesn’t hallucinate the CSS.’ It’s the ultimate ‘low-code’ rebrand, promising non-technical users they can build MVPs by just having a ‘vibe’ while the Gemini agent handles the actual engineering in the background. We’ve gone from ‘no-code’ to ‘low-code’ to ‘just vibes,’ which is exactly how much architectural integrity these apps will have. <a href="https://app.daily.dev/posts/vDejXlEPp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Checkmarx joins the AI security arms race</strong>: Checkmarx is now orchestrating five different AI agents to ‘automate’ vulnerability triage and remediation because apparently, one hallucinating bot wasn’t enough. They’re framing this as a ‘machine-speed’ response to AI-generated code, essentially admitting we’re using bots to fix the security holes created by other bots. It’s a self-perpetuating cycle of automated technical debt where the only winner is the vendor selling the ‘orchestration framework.’ <a href="https://app.daily.dev/posts/PE8tBh7Qo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Durable migrates to Vercel to fire the DevOps team</strong>: Vercel is touting a story about a startup that moved to their platform with six engineers and ‘eliminated’ the need for DevOps. It’s the classic ‘serverless’ lie where you trade a DevOps team for a massive monthly bill and a complete lack of control over your underlying infrastructure. They claim to ship agents in a single day, which is great until you realize ‘shipping’ just means pushing a prompt to a black box you don’t own. <a href="https://app.daily.dev/posts/zNuNcsVh2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
