<h2>Must know</h2>
<ul>
<li><strong>Trivy supply chain attack steals CI/CD credentials</strong>: Aqua Security’s Trivy scanner was compromised in a major supply chain attack that injected credential-stealing malware into official GitHub Actions and binaries. The attack affected 75 version tags, exfiltrating SSH keys, Kubernetes tokens, and cloud credentials to attacker-controlled servers. Maintainers at Aqua Security and the Apache Software Foundation advise pinning actions to full commit SHAs and immediately rotating all pipeline secrets if you ran compromised versions like trivy-action 0.35.0 or setup-trivy 0.2.6. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI pivots to enterprise superapp as Anthropic gains ground</strong>: OpenAI is reportedly merging ChatGPT, Codex, and its internal ‘Atlas’ browser into a single desktop superapp focused on agentic workflows for power users. This strategic shift, led by Fidji Simo, aims to counter Anthropic, which is currently winning roughly 70% of head-to-head enterprise deals. The move signals a departure from simple consumer chatbots toward complex, integrated developer tools, though analysts warn this could dilute the simplicity that made ChatGPT a hit. <a href="https://app.daily.dev/posts/8DNQjej2h" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NVIDIA invests 4 billion in photonics to break the copper wall</strong>: NVIDIA has poured $4 billion into photonics leaders Lumenum and Coherent to replace copper interconnects with optical links in AI clusters. As resistive heat and signal loss become scaling bottlenecks for next-gen training, silicon photonics offers a path to 90% lower energy consumption for matrix operations. This hardware shift is expected to be more influential for AI scaling through 2028 than any specific transformer architecture improvement. <a href="https://app.daily.dev/posts/8q86CzGA8" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Databricks releases DASF 3.0 with 35 new agentic security risks</strong>: The framework now covers ‘Lethal Trifecta’ threats like memory poisoning and tool-based prompt injection for autonomous agents. <a href="https://app.daily.dev/feed-by-ids?id=AAGN81fva&amp;id=DFjCiWDbW&amp;id=IArevVTpt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Asahi Linux brings initial boot support to Apple M3 chips</strong>: New kernel patches enable serial console and initramfs on M3 hardware, though full GPU support remains months away. <a href="https://app.daily.dev/posts/0TBFbIR8n" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wine 11.5 integrates Syscall User Dispatch for Linux gaming</strong>: The update fixes long-standing crashes in titles like Red Dead Redemption 2 by redirecting non-native system calls to user-space. <a href="https://app.daily.dev/posts/1L0pKGR6J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>MoonshotAI claims AttnRes outperforms standard Transformer residuals</strong>: The new Attention Residuals mechanism uses learned pseudo-queries to aggregate content across model depth more efficiently. <a href="https://app.daily.dev/posts/3m6lo1p5Y" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ubuntu 26.04 switches to Rust-based sudo with password feedback</strong>: The ‘Resolute Raccoon’ release will use sudo-rs by default, finally showing asterisks during password entry after 46 years of silence. <a href="https://app.daily.dev/posts/AvXNa15IP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS DataSync adds Secrets Manager support for all locations</strong>: Credential management is now centralized for HDFS, FSx for Windows, and NetApp ONTAP transfers using custom KMS keys. <a href="https://app.daily.dev/posts/DWdtbyORw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest cuts 90 percent of carousel code using native CSS</strong>: Replacing a 2,000-line JavaScript library with 200 lines of CSS improved page load times by 15% and eliminated main-thread jank. <a href="https://app.daily.dev/posts/OmQ3qCuNd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The compound probability math killing your AI agent</strong>: While benchmarks like SWE-bench claim 79% accuracy, real-world multi-step tasks often fail because probabilities compound; an 85% accurate agent on a 10-step task actually succeeds only 20% of the time. Engineering teams are shipping ‘autonomous’ agents without calculating Lusser’s Law, leading to production disasters like Replit’s accidental database deletions. If you aren’t discounting your benchmark hype by at least 50%, you’re just waiting for a cascading hallucination to wreck your infra. <a href="https://app.daily.dev/posts/yjcf3hUcE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NVIDIA DLSS 5 and the death of artistic intent</strong>: NVIDIA is marketing DLSS 5 as an ‘AI-powered breakthrough,’ but developers are revolting because the models are now unironically altering scene lighting and character faces to the point of distortion. It’s essentially the ‘motion smoothing’ of the GPU world, flattening contrast and atmospheric work that took artists decades to master. Jensen Huang’s dismissive response to critics suggests NVIDIA is now an AI infrastructure company that views actual game aesthetics as a secondary data point. <a href="https://app.daily.dev/feed-by-ids?id=BsIJ2t6dP&amp;id=P7dnxxeG8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding and the 45 percent security flaw rate</strong>: The ‘vibe coding’ hype train is hitting a wall of reality where AI-generated code is showing a 45% security flaw rate and making experienced devs 19% slower due to review fatigue. A recent Alibaba study found that 75% of codebases managed by autonomous agents were broken within eight months. Turns out, replacing core engineering logic with a stochastic parrot is great for stock optics but terrible for maintaining a system that actually works. <a href="https://app.daily.dev/posts/IusRVfD2s" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
