<h2>Must know</h2>
<ul>
<li><strong>CanisterWorm hits npm in automated supply chain attack</strong>: Socket’s Threat Research Team identified a worm-enabled attack affecting over 29 packages across the @emilgroup and @teale.io namespaces. The malware harvests npm tokens to autonomously propagate and deploys a Python backdoor that establishes persistence via systemd. This follows the recent Trivy compromise, signaling a coordinated shift toward targeting CI/CD credentials and automated republishing. <a href="https://app.daily.dev/feed-by-ids?id=crpaAf7jK&amp;id=2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NVIDIA invests 4 billion dollars in silicon photonics</strong>: NVIDIA is shifting its AI infrastructure strategy from copper to optical interconnects through massive investments in Lumenum and Coherent. This move addresses the physical limits of copper, such as resistive heat and signal loss, which are becoming bottlenecks for next-generation training clusters. MIT research suggests this hardware transition could reduce matrix multiplication energy consumption by over 90% compared to electronic equivalents. <a href="https://app.daily.dev/posts/8q86CzGA8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>RustSec moderation dispute sparks governance concerns</strong>: A conflict has erupted between cryptographer Nadim Kobeissi and RustSec maintainers over a reported nonce-reuse vulnerability in libraries used by Signal and Google. Kobeissi alleges he was silenced and banned after reporting the flaw, while other experts like Filippo Valsorda argue the risk is overstated and characterize the reporting as harassment. The dispute highlights growing pains in open-source security governance and the subjective nature of vulnerability criticality. <a href="https://app.daily.dev/posts/67iGoAsfX" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Project NOMAD launches as an offline survival knowledge server</strong>: A Docker-orchestrated system bundling Ollama, Wikipedia, and maps for zero-internet environments. <a href="https://app.daily.dev/posts/H7iMtIlvB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Meilisearch memory leak traced to allocator mismatch</strong>: Investigation revealed that using different allocators for LMDB and the main process caused massive RSS growth, resolved by unifying on mimalloc v3. <a href="https://app.daily.dev/posts/eiwrMznlf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ubuntu 26.04 adopts asterisks for sudo password feedback</strong>: Ending 46 years of silent input, the new LTS enables pwfeedback by default via its Rust-based sudo-rs implementation. <a href="https://app.daily.dev/posts/AvXNa15IP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Atuin v18.13 introduces daemon-powered fuzzy search</strong>: The shell history tool now features an in-memory index and a PTY proxy for rendering UI without clearing terminal output. <a href="https://app.daily.dev/posts/BZMIWeFzk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest cuts carousel code by 90 percent using native CSS</strong>: Replacing a 2,000-line JavaScript implementation with 200 lines of CSS improved page load times by 15% and eliminated main-thread jank. <a href="https://app.daily.dev/posts/OmQ3qCuNd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wine 11.5 integrates Linux Syscall User Dispatch</strong>: The update fixes long-standing crashes in games like Red Dead Redemption 2 by redirecting non-native system calls to user-space. <a href="https://app.daily.dev/posts/1L0pKGR6J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Asahi Linux brings initial boot support to Apple M3</strong>: New kernel patches enable basic serial console and initramfs access, though GPU support remains months away. <a href="https://app.daily.dev/posts/0TBFbIR8n" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>NVIDIA NemoClaw and the hardware upsell</strong>: After Jensen Huang called OpenClaw the ‘most important software ever,’ NVIDIA conveniently released NemoClaw to fix its massive security holes. It’s a classic ‘create the problem, sell the cure’ play, as the security runtime is ‘optimized’ for NVIDIA GPUs and pairs perfectly with their $4,000 DGX Spark desktop. Apparently, basic OS-level sandboxing now requires a high-end GPU and a proprietary safety wrapper. <a href="https://app.daily.dev/feed-by-ids?id=JhMlhGtCJ&amp;id=CUnAGy4Zi" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The DLSS 5 artistic integrity crisis</strong>: NVIDIA’s DLSS 5 is being slammed by developers for ‘hallucinating’ lighting and flattening atmospheric contrast to the point of looking like a cheap TV motion-smoothing filter. While tech digests call it a ‘breakthrough,’ actual artists argue it undermines decades of work on atmospheric rendering. It seems NVIDIA is so focused on being an ‘AI company’ they’ve forgotten that graphics are supposed to look like the designer intended, not what a model thinks is ‘bright.’ <a href="https://app.daily.dev/feed-by-ids?id=BsIJ2t6dP&amp;id=P7dnxxeG8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI superapp and the enterprise pivot</strong>: OpenAI is reportedly merging ChatGPT and its internal browser into a ‘desktop superapp’ because they are losing 70% of enterprise deals to Anthropic. They’re framing this as ‘eliminating fragmentation,’ but analysts correctly point out it’s just adding complexity to a tool whose only original strength was simplicity. Good luck managing identity and audit trails for ‘agentic workflows’ when you still haven’t solved basic governance gaps. <a href="https://app.daily.dev/feed-by-ids?id=8DNQjej2h&amp;id=DeubImI4Q" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
