<h2>Must know</h2>
<ul>
<li><strong>Trivy GitHub Actions hit by major supply chain attack</strong>: Attackers compromised the aquasecurity/trivy-action repository, force-pushing malicious payloads to 75 out of 76 version tags. The malware targets CI/CD pipelines to harvest cloud credentials from AWS, GCP, and Azure, as well as SSH keys and Kubernetes tokens. Security researchers at Socket and the Apache Software Foundation recommend immediate rotation of all pipeline secrets for anyone using the affected action. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>VoidZero open sources Vite plus and launches Void platform</strong>: Evan You’s VoidZero has fully open-sourced Vite+ under the MIT license, bundling Vite, Vitest, Rolldown, and the Oxc-based tools into a single high-performance binary called vp. This unified toolchain handles the entire local development lifecycle from package installation to type-checking and building. Alongside this, they launched Void, a specialized deployment platform built on Cloudflare Workers designed specifically for Vite-native applications. <a href="https://app.daily.dev/posts/dbyxVvRUE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>International operation takes down 31 Tbps IoT botnets</strong>: The US Department of Justice, alongside German and Canadian authorities, disrupted four massive IoT botnets including Aisuru and KimWolf. These networks compromised over three million devices like routers and IP cameras to launch some of the largest DDoS attacks ever recorded. While the command-and-control infrastructure was seized, millions of unpatched devices remain vulnerable globally. <a href="https://app.daily.dev/posts/Z5D5TjMr3" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Microsoft rolls back Copilot AI entry points in Windows 11</strong>: Following user feedback, Microsoft is removing AI ‘bloat’ from Photos, Notepad, and Snipping Tool to focus on performance and reliability. <a href="https://app.daily.dev/posts/R3I8JkvR5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Modern CSS features are eliminating hundreds of kilobytes of JavaScript</strong>: Native APIs like Anchor Positioning, Popover, and View Transitions are now viable replacements for libraries like Popper.js and Framer Motion. <a href="https://app.daily.dev/posts/OTVoRLt9s" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google engineer introduces Sashiko AI code reviewer for Linux</strong>: The Rust-based tool found 53% of bugs in upstream testing that were previously missed by human maintainers. <a href="https://app.daily.dev/posts/j5mdnOwUC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Heroku CLI v11 completes full ESM migration</strong>: The overhaul includes oclif v4, Node.js 22 support, and a new semantic color system for improved terminal performance. <a href="https://app.daily.dev/posts/2swWgPS9c" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wine 11.5 adds Linux Syscall User Dispatch support</strong>: This kernel-level feature fixes long-standing crashes in high-profile games like Red Dead Redemption 2 by redirecting system calls. <a href="https://app.daily.dev/posts/1L0pKGR6J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Television is a new Rust-based fuzzy finder with channel support</strong>: It expands on FZF by adding a ‘cable library’ for AWS, Docker, and Kubernetes previews directly in the terminal. <a href="https://app.daily.dev/posts/HAbGCXW9P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>State of JS 2025 shows TypeScript used by 40 percent of devs exclusively</strong>: Vite has officially overtaken Webpack in satisfaction, while React maintains a dominant 83.6% usage rate. <a href="https://app.daily.dev/posts/rcBrZOPNH" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The AI agent math that leads to 80 percent failure</strong>: While marketing hype suggests agents can run your whole business, basic probability shows that an 85% accurate agent on a 10-step task fails 80% of the time. We’re seeing ‘autonomous’ agents delete production databases at Replit and make unauthorized purchases at OpenAI because they can’t handle compound error rates. It’s not ‘agentic reasoning,’ it’s just a very expensive way to play Russian Roulette with your infrastructure. <a href="https://app.daily.dev/posts/u3XWj6eFY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Corporate AI mandates are the new TPS reports</strong>: Amazon and Meta are now tracking AI tool usage in weekly performance reviews, effectively forcing developers to use tools that studies show make them 19% slower. This surveillance-based compliance prioritizes ‘vibe’ metrics over actual output quality, leading to a 45% spike in security flaws in AI-generated code. We’ve reached the point where senior engineers are being paid to babysit hallucinating bots just to satisfy a management dashboard. <a href="https://app.daily.dev/feed-by-ids?id=9KgLLeZB1&amp;id=IusRVfD2s" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The shadow AI security confidence gap</strong>: A ‘Beyond the Black Box’ report reveals that 80% of executives think their AI security is ‘strong,’ while only 40% of the people actually doing the work agree. With 63% of organizations admitting to ‘shadow AI’ usage, the C-suite is essentially celebrating a locked front door while the back wall is missing. The AI supply chain remains a total black box to traditional security tooling, making these executive confidence scores pure fantasy. <a href="https://app.daily.dev/posts/vBiaQRif0" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
