<h2>Must know</h2>
<ul>
<li><strong>Trivy supply chain attack compromises GitHub Actions</strong>: Aqua Security’s Trivy vulnerability scanner suffered a major compromise where attackers force-pushed malicious payloads to 75 out of 76 version tags in the official repository. The malware is designed to dump runner process memory and exfiltrate cloud credentials for AWS, GCP, and Azure, as well as Kubernetes tokens. If your CI/CD pipelines reference any Trivy tags other than @0.35.0, immediate rotation of all secrets is required according to maintainer Itay Shakury. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft rolls back Copilot bloat in Windows 11</strong>: In a surprising pivot reported by Windows Central, Microsoft is removing Copilot AI entry points from core apps like Photos, Notepad, and Snipping Tool to focus on quality and performance. This roadmap shift includes long-requested features like vertical taskbar support and better control over Windows Updates, moving away from forced AI integration. The company claims this is a move toward more intentional AI experiences rather than the previous scattergun approach that many users labeled as bloatware. <a href="https://app.daily.dev/posts/R3I8JkvR5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Law enforcement takes down 31 Tbps IoT botnets</strong>: The US Department of Justice, alongside German and Canadian authorities, disrupted four massive IoT botnets—Aisuru, KimWolf, JackSkid, and Mossad—that controlled over three million compromised devices. These networks were responsible for record-breaking DDoS attacks exceeding 31.4 Tbps and were monetized through extortion and DDoS-for-hire services. While the command-and-control infrastructure was seized, Krebs on Security notes that millions of unpatched routers and IP cameras remain vulnerable online. <a href="https://app.daily.dev/posts/Z5D5TjMr3" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Next.js 16.2 optimizes server component deserialization for 60% faster rendering</strong>: The release replaces JSON.parse reviver callbacks with pure JS recursive walks and adds an <a href="http://agents.md" target="_blank" rel="noopener nofollow">agents.md</a> file for AI context. <a href="https://app.daily.dev/posts/pLH5NluEB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google introduces Sashiko AI code reviewer for the Linux kernel</strong>: Written in Rust and backed by Gemini Pro 3.1, the tool found 53% of bugs in a 1,000-patch test set that human reviewers missed. <a href="https://app.daily.dev/posts/j5mdnOwUC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails 8.1 adds batch SQL schema loading and MySQL online DDL</strong>: New updates improve schema loading performance and introduce native support for non-blocking index and column changes in MySQL. <a href="https://app.daily.dev/feed-by-ids?id=ZyJrfAUW3&amp;id=xzxn9KnpB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Nvidia Nemotron 3 Super 120B MoE model targets agentic coding</strong>: The new model is optimized for terminal workflows and tool use, launching alongside a coalition with Cursor and LangChain. <a href="https://app.daily.dev/posts/2kHgnIWRN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Heroku CLI v11 completes ESM migration and moves to Node 22</strong>: The overhaul uses oclif v4 for faster execution and introduces a semantic color system and command discovery features. <a href="https://app.daily.dev/posts/2swWgPS9c" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Stripe Minions agents now generate 1,300 pull requests weekly</strong>: The autonomous agents handle configuration and dependency upgrades, though all changes still undergo human review. <a href="https://app.daily.dev/posts/2kHgnIWRN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flash-KMeans achieves 200x speedup over FAISS on H200 GPUs</strong>: The implementation optimizes IO overhead and atomic write contention for massive performance gains in vector clustering. <a href="https://app.daily.dev/posts/6XoHm5DKD" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The corporate AI mandate productivity paradox</strong>: Amazon and Meta are now tying AI tool usage to performance reviews, yet METR studies show experienced devs are actually 19% slower when forced to use them. We are witnessing a management-led hallucination where ‘lines of code generated’ is being confused with ‘value created,’ despite AI-generated code having a 45% security flaw rate. It’s a race to the bottom where we trade developer skill retention for a mountain of technical debt that no one actually understands. <a href="https://app.daily.dev/feed-by-ids?id=9KgLLeZB1&amp;id=IusRVfD2s&amp;id=W9FropxM1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The math that is quietly killing your autonomous agents</strong>: Hype cycles ignore the ‘lethal trifecta’ of compound probability: an agent with 85% accuracy on a 10-step task succeeds only 20% of the time. We’re seeing ‘vibe coders’ celebrate 1,300 PRs a week while ignoring that 80% of codebases break after just eight months of autonomous operation. No amount of ‘agentic reasoning’ can fix the fact that model speciation and jaggedness make these systems fundamentally unpredictable in production. <a href="https://app.daily.dev/feed-by-ids?id=2kHgnIWRN&amp;id=IusRVfD2s" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Shadow AI and the executive confidence gap</strong>: A ‘Beyond the Black Box’ report reveals 80% of execs think their AI security is ‘strong,’ while only 40% of the people actually doing the work agree. Meanwhile, 63% of organizations have ‘shadow AI’ running wild, and enterprise identity systems are 82-to-1 outnumbered by machine identities they can’t track. It’s a classic case of leadership buying the marketing brochure while the engineering team tries to figure out how to rotate secrets for a bot they didn’t know existed. <a href="https://app.daily.dev/feed-by-ids?id=1prgvqWuk&amp;id=mjYZLu95c" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
