<h2>Must know</h2>
<ul>
<li><strong>Trivy supply chain attack compromises GitHub Actions</strong>: Aqua Security’s Trivy vulnerability scanner suffered a major supply chain compromise where attackers force-pushed malicious payloads to 75 out of 76 version tags. The malware targets CI/CD pipelines to harvest SSH keys, cloud credentials for AWS, GCP, and Azure, and Kubernetes tokens from runner memory. Security researchers at Socket and the Apache Software Foundation recommend immediate rotation of all pipeline secrets for any workflows that executed the compromised actions. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft rolls back Copilot integration in Windows 11</strong>: In a surprising pivot reported by Windows Central, Microsoft is removing Copilot AI entry points from core applications like Photos, Notepad, and Snipping Tool to focus on performance and reliability. This shift follows internal data and a Pew Research study showing significant consumer concern over AI bloat. The new roadmap prioritizes ‘Performance, Reliability, and Craft,’ including long-requested features like vertical taskbar support and improved memory efficiency. <a href="https://app.daily.dev/posts/R3I8JkvR5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>International task force dismantles 31 Tbps IoT botnets</strong>: The US Department of Justice, alongside German and Canadian authorities, disrupted four massive IoT botnets—Aisuru, KimWolf, JackSkid, and Mossad—that controlled over three million compromised devices. These networks were responsible for record-breaking DDoS attacks exceeding 31.4 Tbps and were monetized through extortion and DDoS-for-hire services. While the command-and-control infrastructure was seized, Krebs on Security notes that millions of unpatched routers and IP cameras remain vulnerable online. <a href="https://app.daily.dev/posts/Z5D5TjMr3" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Next.js 16.2 optimizes rendering via recursive walks</strong>: The update replaces JSON.parse reviver callbacks with pure JavaScript recursive walks for up to 60% faster HTML rendering. <a href="https://app.daily.dev/posts/pLH5NluEB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Nvidia launches Nemotron 3 Super for agentic workflows</strong>: A new 120B parameter MoE model optimized specifically for terminal interactions and tool use is now available via API. <a href="https://app.daily.dev/posts/2kHgnIWRN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Sashiko brings AI code review to the Linux kernel</strong>: A Rust-based tool from Google engineers found 53% of bugs in upstream testing that were previously missed by human reviewers. <a href="https://app.daily.dev/posts/j5mdnOwUC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft unifies SQL and Fabric data platforms</strong>: Announcements at SQLCon 2026 introduced a converged management plane for Azure SQL, Cosmos DB, and PostgreSQL within Fabric. <a href="https://app.daily.dev/posts/9lGZhe2Qp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Heroku CLI v11 completes ESM migration</strong>: The architectural overhaul moves to oclif v4 and Node.js 22, delivering significantly faster command execution and theme support. <a href="https://app.daily.dev/posts/2swWgPS9c" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flash-KMeans achieves 33x speedup over cuML</strong>: A new GPU-optimized implementation on H200s uses cache-aware compile heuristics to drastically reduce IO overhead. <a href="https://app.daily.dev/posts/fGQv2cjZG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>State of JavaScript 2025 shows TypeScript dominance</strong>: The latest survey reveals 40% of developers now use TypeScript exclusively, while Vite has effectively replaced Webpack. <a href="https://app.daily.dev/posts/rcBrZOPNH" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The 1000x faster database benchmark trap</strong>: SpacetimeDB is claiming 1000x performance over PostgreSQL by essentially being an in-memory database that co-locates app code. Comparing a specialized RAM-resident engine to a general-purpose disk-based RDBMS is the oldest trick in the marketing playbook. It’s fast until your dataset exceeds your memory budget or you actually need the durability guarantees you’re bypassing. <a href="https://app.daily.dev/posts/fgMT5xF5i" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Corporate AI mandates vs reality</strong>: Amazon and Meta are now tying AI tool usage to performance reviews, despite research showing experienced devs are 19% slower with these tools. We are officially in the ‘compliance over quality’ era where checking a ‘used AI’ box matters more than the 45% security flaw rate in the resulting code. It’s a race to the bottom where we trade developer skill retention for a mountain of unreviewable pull requests. <a href="https://app.daily.dev/feed-by-ids?id=9KgLLeZB1&amp;id=IusRVfD2s&amp;id=W9FropxM1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The math that kills the agent hype</strong>: While everyone is pitching ‘autonomous agents,’ the compound probability of a 10-step task with 85% accuracy results in a measly 20% success rate. This explains why 80% of AI-rebuilt codebases break within months and why ‘Operator’ keeps making unauthorized purchases. We’re being sold ‘autonomy’ when what we’re actually getting is a very expensive way to delete production databases. <a href="https://app.daily.dev/feed-by-ids?id=2kHgnIWRN&amp;id=IusRVfD2s" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
