<h2>Must know</h2>
<ul>
<li><strong>Trivy supply chain attack compromises GitHub Actions</strong>: Hackers compromised Aqua Security’s Trivy vulnerability scanner, injecting malicious code into nearly all versions of the trivy-action and trivy-setup GitHub Actions. The malware specifically targets CI/CD pipelines to exfiltrate GitHub tokens, cloud credentials, and Kubernetes secrets to attacker-controlled servers. Maintainers advise an immediate rotation of all pipeline secrets if you’ve run any version other than 0.35.0 recently. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Sashiko brings AI code review to the Linux kernel</strong>: Google engineer Roman Gushchin introduced Sashiko, a Rust-based AI tool designed to analyze Linux kernel patches from mailing lists. In initial testing against 1,000 upstream bugs, it identified 53% of issues that human reviewers had completely missed. Now hosted under the Linux Foundation, the tool is positioned strictly as a maintainer aid to avoid the controversy surrounding AI-generated code submissions. <a href="https://app.daily.dev/posts/j5mdnOwUC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Germany mandates OpenDocument formats for government</strong>: The German government’s new Deutschland-Stack framework officially mandates the use of ODF and PDF/UA across all public administrations by 2028. This policy explicitly excludes proprietary Microsoft formats like .doc and .xls to reduce vendor lock-in and promote European digital sovereignty. The Document Foundation has hailed the move as a fundamental shift toward vendor-neutral public infrastructure. <a href="https://app.daily.dev/posts/ffG1g9Lse" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Claude Code best practices for task based workflows</strong>: A new guide outlines 50 patterns for Claude Code, including sandboxing destructive commands with PreToolUse hooks and managing multi-agent orchestration. <a href="https://app.daily.dev/posts/WcA6EquDZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Caliber CLI automates AI agent project configuration</strong>: This open-source tool fingerprints project architecture to generate tailored configurations for Claude Code, Cursor, and Codex with local drift detection. <a href="https://app.daily.dev/posts/BlkKH076B" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust WASM boundary overhead triggers TypeScript rewrites</strong>: Engineers reported a 4.6x performance gain by moving a DSL parser from Rust-WASM to TypeScript, citing interop costs as the primary bottleneck for small inputs. <a href="https://app.daily.dev/posts/l5Hpi7Vvy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Model Context Protocol gains traction for tool standardization</strong>: MCP is emerging as a vendor-neutral JSON-RPC layer to separate AI tools from specific providers, though 43% of early servers show injection vulnerabilities. <a href="https://app.daily.dev/feed-by-ids?id=8u17t9D3J&amp;id=aVkd63KZc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SingleStore 9.1 adds F16 vector types</strong>: The new 16-bit floating point type halves storage requirements for embeddings and speeds up kNN queries by 38% with negligible recall loss. <a href="https://app.daily.dev/posts/xRqtno45x" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Proton Mail metadata shared with FBI via Swiss order</strong>: A recent disclosure reveals Proton shared subscriber payment metadata following a legal order, highlighting the limits of privacy-focused email providers. <a href="https://app.daily.dev/posts/79nZrB3SL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bun v1.3.11 and Ruby 4.0.2 released</strong>: The latest language ecosystem updates include performance patches for Bun and a security-focused minor release for Ruby. <a href="https://app.daily.dev/posts/P7dnxxeG8" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Amazon loses 6 million orders to vibe coding</strong>: Amazon reportedly mandated an 80% AI tool usage rate for engineers, only to suffer a six-hour outage because junior devs ‘vibe coded’ their way into production failures they couldn’t debug. It turns out that ‘triage slop’—AI-generated alerts that look professional but mean nothing—is a great way to burn $100M in a single afternoon. Maybe senior sign-off should involve checking if the code actually works instead of just checking if the AI used a polite tone. <a href="https://app.daily.dev/feed-by-ids?id=kWuil8E6j&amp;id=qbUFVk9kz" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Delve fabricates compliance for the lazy</strong>: YC-backed startup Delve is allegedly using ‘certification mills’ in India to rubber-stamp identical SOC 2 reports for hundreds of clients. They’ve essentially automated the process of lying to auditors, leaving NASDAQ-traded companies with HIPAA liability and a paper trail of script-generated errors. It’s the ultimate ‘fake it until you get sued’ business model for the GRC space. <a href="https://app.daily.dev/posts/zmPU272WX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The enshittification of Adobe reaches the DOJ</strong>: Adobe ‘settled’ with the DOJ for a measly $150M over its predatory cancellation fees and dark patterns, which is basically a 0.3% tax on their revenue for the privilege of continuing to abuse customers. The settlement doesn’t even require them to change their business practices, proving once again that if the penalty is a fine, it’s just a line item in the budget. It’s a masterclass in extracting maximum value while providing a deteriorating product experience. <a href="https://app.daily.dev/posts/wz1Ndpn1m" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
