<h2>Must know</h2>
<ul>
<li><strong>Trivy GitHub Actions compromised in credential theft campaign</strong>: Aqua Security’s Trivy vulnerability scanner suffered a major supply chain attack where malicious payloads were force-pushed to 75 out of 76 version tags in its GitHub Actions repository. The malware targets CI/CD pipelines to dump runner process memory and exfiltrate cloud credentials for AWS, GCP, and Azure, along with Kubernetes tokens. Maintainers advise an immediate rotation of all pipeline secrets for any environment that executed the compromised actions. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Global police operation takes down 31 Tbps IoT botnets</strong>: International law enforcement agencies from the US, Germany, and Canada disrupted four massive IoT botnets—Aisuru, KimWolf, JackSkid, and Mossad—responsible for DDoS attacks peaking at 31.4 Tbps. The operation seized command-and-control infrastructure and domains linked to over three million compromised devices, including routers and IP cameras. While the infrastructure is down, millions of unpatched IoT devices remain vulnerable and online, according to reports from Krebs on Security. <a href="https://app.daily.dev/posts/Z5D5TjMr3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New security framework addresses lethal trifecta in AI agents</strong>: Databricks has updated its Security Framework (DASF v3.0) to include 35 new technical risks specifically targeting autonomous AI agents, such as memory poisoning and tool-based prompt injection. The framework identifies a lethal trifecta of risks: access to sensitive data, the ability to execute actions via MCP, and insufficient human oversight. Security researchers from Netskope warn that these vulnerabilities, particularly rug pull attacks on malicious servers, cannot be patched away and require strict isolation at the container and network levels. <a href="https://app.daily.dev/feed-by-ids?id=1prgvqWuk&amp;id=AAGN81fva&amp;id=mjYZLu95c" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Next.js 16.2 boosts dev server performance</strong>: Next.js 16.2 claims 400% faster dev server startup and introduces an <a href="http://agents.md" target="_blank" rel="noopener nofollow">agents.md</a> file for providing project context to AI coding tools. <a href="https://app.daily.dev/posts/pLH5NluEB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Television fuzzy finder challenges fzf with channel system</strong>: Television is a new Rust-based fuzzy finder that uses a channel-based architecture to replace multiple utilities like fzf and kubectx. <a href="https://app.daily.dev/posts/HAbGCXW9P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Sonar CLI simplifies local port and service management</strong>: Sonar is a new CLI tool that unifies lsof and ss functionality to manage localhost services, Docker containers, and process resource usage. <a href="https://app.daily.dev/posts/G9zhBa0uO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Datadog Terraform provider v4.0.0 reaches general availability</strong>: The Datadog Terraform provider v4.0.0 introduces a unified AWS integration resource and migrates to the modern Terraform plugin framework. <a href="https://app.daily.dev/posts/b6c4oTDZQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flash-KMeans achieves massive GPU performance gains</strong>: Flash-KMeans delivers up to 17.9x speedup over existing baselines on NVIDIA H200 GPUs by optimizing IO overhead and atomic write contention. <a href="https://app.daily.dev/posts/fGQv2cjZG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Hierarchical policy models solve flat Kubernetes network scaling</strong>: A new security hierarchy approach for Kubernetes networks recommends grouping policies into platform, security, and application tiers to manage scale. <a href="https://app.daily.dev/posts/3DB1pD0hc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vite+ goes fully open source under VoidZero</strong>: VoidZero has open-sourced Vite+ under the MIT license, bundling the full local development lifecycle into a single binary called vp. <a href="https://app.daily.dev/posts/dbyxVvRUE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The mandatory AI productivity theater</strong>: Amazon is reportedly tracking developer AI tool usage weekly via its ‘Clarity’ system and tying it to performance reviews, despite studies showing experienced devs are 19% slower with these tools. It’s a bold strategy to mandate 80% adoption of ‘Kira’ while simultaneously requiring senior engineers to sign off on the resulting flood of AI-generated garbage. Nothing says ‘innovation’ like forcing experts to babysit a bot that introduces security flaws 45% of the time. <a href="https://app.daily.dev/feed-by-ids?id=9KgLLeZB1&amp;id=IusRVfD2s&amp;id=W9FropxM1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding and the compound probability trap</strong>: The ‘vibe coding’ trend has reached its logical conclusion with claims that 100% AI-driven projects are ‘stupid fast,’ conveniently ignoring that success rates plummet to 20% on multi-step tasks due to compound probability. We’re being told that ‘System 2’ human judgment is the only thing that matters now, which is a fancy way of saying you’re still responsible when the agent deletes your production database. It’s not a software factory; it’s a high-speed technical debt generator with a chat interface. <a href="https://app.daily.dev/feed-by-ids?id=7sUJFgexb&amp;id=K8nrqrSpN&amp;id=ypIaCKz6j" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Sashiko and the AI kernel review fantasy</strong>: Google’s new ‘Sashiko’ tool is being pitched as a ‘maintainer aid’ for the Linux kernel, claiming it found bugs that human reviewers missed. While it’s nice that Google is paying the Gemini API bills, sending kernel patches to external LLM providers for ‘review’ is a security auditor’s fever dream. It’s a classic ‘AI will save us’ play that ignores the irony of using a black box to verify the most critical open-source code on the planet. <a href="https://app.daily.dev/posts/j5mdnOwUC" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
