<h2>Must know</h2>
<ul>
<li><strong>Trivy GitHub Actions hit by major supply chain attack</strong>: Aqua Security’s Trivy vulnerability scanner was compromised via a force-push attack affecting 75 out of 76 version tags in its GitHub Actions repository. The malware harvests cloud credentials from AWS, GCP, and Azure, steals SSH keys, and dumps runner process memory to an attacker-controlled server. If your CI/CD pipelines use aquasecurity/trivy-action, rotate all secrets immediately as over 10,000 workflow files are estimated to be impacted. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft rolls back Copilot bloat in Windows 11</strong>: Following significant user pushback and performance concerns, Microsoft is removing Copilot entry points from core apps like Notepad, Snipping Tool, and File Explorer. The company is pivoting toward a quality-focused roadmap centered on ‘Performance, Reliability, and Craft,’ which includes long-requested features like vertical taskbar support and better Windows Update control. This retreat suggests that even for the biggest players, shoving AI into every UI corner has reached a point of diminishing returns. <a href="https://app.daily.dev/posts/R3I8JkvR5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Law enforcement dismantles IoT botnets responsible for 31 Tbps attacks</strong>: An international operation involving the DOJ and German authorities disrupted four massive IoT botnets—Aisuru, KimWolf, JackSkid, and Mossad—that controlled over three million compromised devices. These networks were used for record-breaking DDoS attacks and extortion, with operators as young as 15 years old identified in Germany. While the command-and-control infrastructure was seized, millions of unpatched routers and IP cameras remain vulnerable on the open web. <a href="https://app.daily.dev/posts/Z5D5TjMr3" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Nvidia launches Nemotron 3 Super for agentic coding</strong>: A 120B parameter MoE model optimized specifically for terminal workflows and tool use with a free OpenAI-compatible API. <a href="https://app.daily.dev/posts/2kHgnIWRN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Stripe Minions are generating 1,300 pull requests weekly</strong>: Stripe’s autonomous agents now handle configuration and dependency upgrades, though all changes still require human review. <a href="https://app.daily.dev/posts/2kHgnIWRN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>EsoLang-Bench proves LLMs are mostly memorizing code</strong>: Frontier models scoring 90% on Python benchmarks collapse to 3% accuracy when tested on esoteric languages like Brainfuck. <a href="https://app.daily.dev/posts/5rUZDVSxD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Sashiko brings AI code review to the Linux kernel</strong>: A Rust-based tool from Google found 53% of bugs in upstream testing that were previously missed by human maintainers. <a href="https://app.daily.dev/posts/j5mdnOwUC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TypeScript usage hits 40 percent exclusive adoption</strong>: The 2025 State of JS survey shows TypeScript cementing its dominance while Vite has effectively replaced Webpack in developer satisfaction. <a href="https://app.daily.dev/posts/rcBrZOPNH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks DASF v3.0 adds security controls for AI agents</strong>: The update identifies 35 new technical risks including ‘agent reasoning loop attacks’ and tool poisoning. <a href="https://app.daily.dev/posts/1prgvqWuk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft unifies SQL and Fabric into a single data platform</strong>: The convergence includes GitHub Copilot for SSMS 22 and a new Database Hub for managing multi-cloud SQL instances. <a href="https://app.daily.dev/posts/9lGZhe2Qp" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The AI mandate surveillance state</strong>: Amazon and Meta are now reportedly tracking AI tool usage weekly and tying it to performance reviews, because nothing says ‘innovation’ like forcing developers to use a tool that makes them 19% slower. Research shows these mandates prioritize tool usage over output quality, essentially rewarding engineers for generating more technical debt faster. It’s a management masterclass in turning a productivity tool into a compliance metric that everyone will eventually learn to game. <a href="https://app.daily.dev/feed-by-ids?id=9KgLLeZB1&amp;id=IusRVfD2s" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The math that’s killing your autonomous agent</strong>: While marketing teams promise autonomous agents will run your business, the reality of compound probability means an 85% accurate agent only has a 20% chance of finishing a 10-step task. We’re seeing ‘agentic’ systems delete production databases or make unauthorized purchases because they lack the basic common sense to stop when they’re confused. Calling a sequence of probabilistic guesses ‘autonomous’ is just a rebranding of ‘unpredictable failure mode.’ <a href="https://app.daily.dev/posts/2kHgnIWRN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe design is just Figma with a voice filter</strong>: Google’s new ‘vibe design’ for Stitch claims to let you grow ideas from ‘any form’ into working prototypes using an infinite canvas and voice critiques. In reality, it’s another attempt to bypass the hard work of design systems with generative UI that usually falls apart the moment you need a custom breakpoint or a complex state. It’s great for making a demo that looks like a real app, but less great for building something that actually has to work in production. <a href="https://app.daily.dev/feed-by-ids?id=HXzqyp5Oo&amp;id=2kHgnIWRN" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
