<h2>Must know</h2>
<ul>
<li><strong>Trivy supply chain attack compromises GitHub Actions</strong>: Aqua Security’s Trivy vulnerability scanner suffered a major compromise where attackers force-pushed malicious payloads to 75 out of 76 version tags in its GitHub Actions repository. The malware targets CI/CD pipelines to harvest cloud credentials from AWS, GCP, and Azure, as well as SSH keys and Kubernetes tokens. Security researchers at Socket and the Apache Software Foundation advise immediate rotation of all pipeline secrets for any project that ran the affected actions recently. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>International operation dismantles 31 Tbps IoT botnets</strong>: The US Department of Justice, alongside German and Canadian authorities, disrupted four massive IoT botnets—Aisuru, KimWolf, JackSkid, and Mossad—responsible for record-breaking DDoS attacks. Over three million compromised devices including routers and IP cameras were part of the network, which was monetized through extortion and DDoS-for-hire services. While command-and-control infrastructure was seized, Krebs on Security notes that millions of unpatched devices remain online and vulnerable to reinfection. <a href="https://app.daily.dev/posts/Z5D5TjMr3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft pivots to unified data platform and AI agents</strong>: At SQLCon 2026, Microsoft announced the convergence of its database portfolio into Microsoft Fabric, introducing a unified ‘Database Hub’ for managing Azure SQL, Cosmos DB, and PostgreSQL. The update includes general availability for GitHub Copilot in SSMS 22 and new ‘Fabric data agents’ designed to automate enterprise workflows. This strategic shift aims to bridge the ‘context gap’ in AI by providing models with direct, governed access to structured organizational data. <a href="https://app.daily.dev/feed-by-ids?id=9lGZhe2Qp&amp;id=1prgvqWuk" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>OpenAI moves into the Python toolchain</strong>: OpenAI acquired Astral, the creator of Ruff and uv, to integrate high-performance Rust-based tooling directly into the Codex development lifecycle. <a href="https://app.daily.dev/posts/hZi5BxC8m" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Sashiko brings AI code review to the Linux kernel</strong>: A Google engineer introduced a Rust-based tool that caught 53% of upstream bugs missed by human reviewers during testing. <a href="https://app.daily.dev/posts/j5mdnOwUC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vite+ goes fully open source under MIT</strong>: VoidZero released the Vite+ alpha, bundling Vite, Vitest, and Rolldown into a single binary for the full local development lifecycle. <a href="https://app.daily.dev/posts/dbyxVvRUE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Sonar CLI simplifies localhost port management</strong>: A new tool replaces lsof and ss with a unified table showing process names, Docker containers, and resource usage for listening ports. <a href="https://app.daily.dev/posts/G9zhBa0uO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>MicroCloud Cluster Manager enters beta</strong>: Canonical’s new Go-based tool manages lightweight cloud clusters across edge and data center environments using Juju and PostgreSQL. <a href="https://app.daily.dev/posts/oRpwWEcYS" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>BYOC is the new observability meta</strong>: The industry is shifting toward ‘Bring Your Own Cloud’ telemetry to avoid the massive egress and ingestion costs of SaaS platforms like Datadog. <a href="https://app.daily.dev/posts/ZAGKAZVt4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flash-KMeans hits 200x speedup on H200 GPUs</strong>: A new GPU-optimized implementation significantly outperforms FAISS by addressing IO overhead and atomic write contention. <a href="https://app.daily.dev/posts/fGQv2cjZG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The math that is quietly killing your AI agents</strong>: Marketing teams love ‘autonomous agents,’ but basic probability is their executioner: an agent with 85% accuracy on a 10-step task has a measly 20% chance of actually finishing correctly. We are seeing ‘Operator’ models making unauthorized purchases and deleting production databases because they can’t handle the compound error rates of multi-step reasoning. It’s not ‘autonomy’ if you have to babysit every single token to ensure the agent doesn’t hallucinate a sudo command. <a href="https://app.daily.dev/posts/sinZXsyhK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft rolls back the Copilot bloatware</strong>: After spending a year shoving Copilot into every pixel of Windows 11, Microsoft is ‘intentionally’ removing it from Notepad, Snipping Tool, and File Explorer. They’re framing this as a focus on ‘quality and craft,’ but it’s a clear admission that users find the AI integrations intrusive and useless. It turns out people just want a functional operating system, not a chatbot that pops up every time they try to take a screenshot. <a href="https://app.daily.dev/posts/R3I8JkvR5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Corporate AI mandates are the new surveillance</strong>: Amazon and Meta are now tracking AI tool usage in weekly performance reviews, effectively forcing developers to use tools that studies show make them 19% slower. This isn’t about productivity; it’s about metrics-driven compliance that rewards tool adoption over actual output quality. We’re mandating the use of systems that generate 45% security flaw rates just so middle management can put ‘AI-powered’ in their quarterly reports. <a href="https://app.daily.dev/feed-by-ids?id=9KgLLeZB1&amp;id=IusRVfD2s" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
