<h2>Must know</h2>
<ul>
<li><strong>Trivy supply chain attack compromises GitHub Actions</strong>: Attackers force-pushed malicious payloads to 75 out of 76 version tags in the popular aquasecurity/trivy-action repository, targeting CI/CD pipelines to harvest cloud credentials and Kubernetes tokens. Socket and the Apache Software Foundation confirmed the malware exfiltrates stolen data from GitHub Secrets to attacker-controlled servers. If you use Trivy in your workflows, rotate all pipeline secrets immediately and pin to version 0.35.0, which was the only tag left untouched. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The lethal trifecta of AI agent security</strong>: Databricks released DASF v3.0, identifying a core threat model for autonomous agents: the combination of sensitive data access, the ability to take actions, and insufficient human oversight. New research from Netskope highlights that vulnerabilities like indirect prompt injection and tool poisoning in the Model Context Protocol cannot be patched away. Securing these agents requires a shift toward machine identity standards like SPIFFE/SPIRE and isolated container environments to prevent cascading hallucinations from becoming production disasters. <a href="https://app.daily.dev/feed-by-ids?id=1prgvqWuk&amp;id=AAGN81fva&amp;id=DFjCiWDbW&amp;id=MKFydyly9&amp;id=UuPCBlonX&amp;id=mjYZLu95c&amp;id=vBiaQRif0&amp;id=xZwNeD2wp&amp;id=xkSVzfHBH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>International sting disrupts 31 Tbps IoT botnets</strong>: The US Department of Justice, alongside German and Canadian authorities, dismantled four massive IoT botnets—Aisuru, KimWolf, JackSkid, and Mossad—responsible for record-breaking DDoS attacks. According to Krebs on Security, the operation seized command-and-control infrastructure linked to over three million compromised devices worldwide. While the infrastructure is down, millions of unpatched routers and IP cameras remain online, leaving the door open for the next wave of botnet operators. <a href="https://app.daily.dev/posts/Z5D5TjMr3" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Next.js 16.2 adds native AI agent context</strong>: The release includes an <a href="http://agents.md" target="_blank" rel="noopener nofollow">agents.md</a> file by default to provide coding agents with framework-specific knowledge and debugging tools. <a href="https://app.daily.dev/feed-by-ids?id=pLH5NluEB&amp;id=sfhWCoTDT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Modern CSS is killing JavaScript libraries</strong>: Native features like Anchor Positioning, Popover API, and Scroll-Driven Animations are replacing GSAP and Framer Motion, saving up to 322kB in bundle size. <a href="https://app.daily.dev/posts/OTVoRLt9s" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft unifies data platform with Fabric and SQL updates</strong>: Azure SQL Database Hyperscale now supports AI agent connectivity via MCP and integrated vector indexing for RAG workflows. <a href="https://app.daily.dev/posts/9lGZhe2Qp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>State of JS 2025 shows TypeScript dominance</strong>: TypeScript is now used exclusively by 40% of developers, while Vite has effectively replaced Webpack with a 98% satisfaction score. <a href="https://app.daily.dev/posts/rcBrZOPNH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google introduces Sashiko for Linux kernel reviews</strong>: This Rust-based AI tool found 53% of bugs in upstream testing that were previously missed by human maintainers. <a href="https://app.daily.dev/posts/j5mdnOwUC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flat Kubernetes networks fail at scale</strong>: Large environments are moving toward security hierarchies with explicit policy precedence to manage multi-team AI workloads. <a href="https://app.daily.dev/posts/3DB1pD0hc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NVIDIA DLSS 5 rewrites graphics with AI</strong>: The latest iteration uses neural rendering to reconstruct frames, moving beyond simple upscaling to full AI-generated graphics. <a href="https://app.daily.dev/posts/P7dnxxeG8" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The 19 percent productivity tax</strong>: While CEOs scream about AI doubling output, a METR study reveals experienced developers are actually 19% slower when using AI tools due to the ‘review fatigue’ of fixing hallucinated garbage. Amazon’s mandate for senior engineers to sign off on all AI-generated code has created a massive bottleneck, proving that ‘vibe coding’ is just technical debt with a better marketing budget. We’re essentially paying a premium to turn our best engineers into high-priced janitors for LLM output. <a href="https://app.daily.dev/feed-by-ids?id=IusRVfD2s&amp;id=9KgLLeZB1&amp;id=W9FropxM1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft’s intentional bloat removal</strong>: Microsoft is framing the removal of Copilot from the Windows 11 taskbar and Notepad as being ‘more intentional’ about the user experience. In reality, they’re rolling back features because half of U.S. users are more concerned than excited about AI, and the ‘genuinely useful’ experiences they promised turned out to be intrusive sidebar ads. It’s not a pivot to quality; it’s a retreat from a product that nobody asked for in their Snipping Tool. <a href="https://app.daily.dev/posts/R3I8JkvR5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The math that’s killing your agent</strong>: The industry is ignoring the compound probability trap: an agent with 85% accuracy on a 10-step task only succeeds 20% of the time. Despite this, companies like Replit and OpenAI are giving these agents production database access and credit cards, leading to ‘accidental’ deletions and unauthorized purchases. It turns out that ‘autonomous’ is just another word for ‘unpredictable and expensive to fix.’ <a href="https://app.daily.dev/feed-by-ids?id=u3XWj6eFY&amp;id=zNvsjajq7" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
