<h2>Must know</h2>
<ul>
<li><strong>Trivy GitHub Actions supply chain compromise</strong>: A major supply chain attack has hit Aqua Security’s Trivy vulnerability scanner, with attackers force-pushing malicious payloads to 75 out of 76 version tags in the official GitHub Actions repository. The malware targets CI/CD pipelines to harvest cloud credentials from AWS, GCP, and Azure, as well as Kubernetes tokens and SSH keys. Security teams must immediately rotate all pipeline secrets if they ran any version other than @0.35.0, as the Apache Software Foundation has already confirmed impact on several projects. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>International law enforcement disrupts 31 Tbps IoT botnets</strong>: The US Department of Justice, alongside German and Canadian authorities, dismantled four massive IoT botnets—Aisuru, KimWolf, JackSkid, and Mossad—responsible for record-breaking DDoS attacks exceeding 31.4 Tbps. While the command-and-control infrastructure and US-registered domains were seized, over three million compromised devices like routers and IP cameras remain unpatched and online. Krebs on Security reports the suspected operators include a 22-year-old Canadian and a 15-year-old German national. <a href="https://app.daily.dev/posts/Z5D5TjMr3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft unifies data platform with Fabric and AI</strong>: At SQLCon 2026, Microsoft announced the convergence of its database portfolio into Microsoft Fabric, creating a unified management plane for Azure SQL, Cosmos DB, and PostgreSQL. Key updates include the general availability of GitHub Copilot in SSMS 22 for T-SQL assistance and new vector indexing capabilities for AI agent connectivity in Azure SQL Hyperscale. The company also introduced a Database Hub in Fabric to provide agent-assisted observability across multi-cloud and on-premises SQL environments. <a href="https://app.daily.dev/posts/9lGZhe2Qp" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Microsoft rolls back Copilot AI integration in Windows 11</strong>: The company is removing AI entry points from Notepad and File Explorer to focus on performance and ‘intentional’ features following user backlash. <a href="https://app.daily.dev/posts/R3I8JkvR5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks DASF v3.0 adds security controls for AI agents</strong>: The update introduces 35 new technical risks and mitigation controls specifically for autonomous agent reasoning loops and tool poisoning. <a href="https://app.daily.dev/posts/1prgvqWuk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google introduces Sashiko AI code reviewer for Linux</strong>: Written in Rust, this tool found 53% of bugs in upstream testing that were previously missed by human maintainers. <a href="https://app.daily.dev/posts/j5mdnOwUC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DuckDB ExtensionKit enables C# native extensions</strong>: A new toolkit uses .NET Native AOT to compile C# code into native DuckDB extensions with no managed runtime dependency. <a href="https://app.daily.dev/posts/7ppDdKC9k" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Stripe Minions generate 1300 pull requests weekly</strong>: Stripe is using autonomous agents for configuration and dependency tasks, though all changes still require human review. <a href="https://app.daily.dev/posts/gcPJlzGP1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vulkan 1.4.347 adds GPU fault reporting extensions</strong>: The new release includes VK_KHR_device_fault for retrieving vendor-specific crash post-mortem info and binary crash dumps. <a href="https://app.daily.dev/posts/j6kOb9pKZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>BYOC observability emerges as SaaS alternative</strong>: New ‘Bring Your Own Cloud’ models allow deploying observability stacks inside private VPCs to eliminate egress and ingestion costs. <a href="https://app.daily.dev/posts/ZAGKAZVt4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The corporate AI mandate surveillance trap</strong>: Amazon and Meta are now tying AI tool usage directly to performance reviews, with Amazon’s ‘Clarity’ system tracking weekly usage metrics like a digital hall monitor. This ignores research showing experienced devs are actually 19% slower with these tools, effectively rewarding ‘vibe’ metrics over actual output quality. It’s a management masterclass in turning a productivity tool into a compliance-driven nightmare that erodes senior engineering autonomy. <a href="https://app.daily.dev/feed-by-ids?id=9KgLLeZB1&amp;id=IusRVfD2s" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The math that’s killing your autonomous agent</strong>: Hype cycles conveniently ignore that an 85% accurate agent on a 10-step task has a measly 20% chance of total success due to compound probability. We’re seeing ‘autonomous’ agents delete production databases at Replit and make unauthorized purchases at OpenAI because ‘agentic’ is currently just a fancy word for ‘unpredictable.’ Until we solve the cascading hallucination problem, these agents are just high-speed technical debt generators. <a href="https://app.daily.dev/feed-by-ids?id=u3XWj6eFY&amp;id=IusRVfD2s" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
