<h2>Must know</h2>
<ul>
<li><strong>Trivy GitHub Actions hit by major supply chain attack</strong>: Attackers compromised Aqua Security’s Trivy vulnerability scanner by force-pushing malicious payloads to 75 out of 76 version tags in its GitHub Actions repository. The malware targets CI/CD pipelines to harvest SSH keys, cloud credentials for AWS, GCP, and Azure, and Kubernetes tokens from runner memory. Socket and the Apache Software Foundation report that over 10,000 workflow files are affected, necessitating an immediate rotation of all pipeline secrets for users of the trivy-action or trivy-setup actions. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>International operation dismantles 31 Tbps IoT botnets</strong>: The US Department of Justice, alongside German and Canadian authorities, disrupted four massive IoT botnets—Aisuru, KimWolf, JackSkid, and Mossad—responsible for record-breaking DDoS attacks. According to Krebs on Security, the operation seized command-and-control infrastructure linked to over three million compromised devices, including routers and IP cameras. While the infrastructure is down, millions of unpatched devices remain vulnerable globally, and two young operators in Canada and Germany have been identified. <a href="https://app.daily.dev/posts/Z5D5TjMr3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft rolls back Copilot integration in Windows 11</strong>: Responding to user feedback and performance concerns, Microsoft is removing Copilot AI entry points from core Windows 11 apps like Photos, Notepad, and Snipping Tool. The company is pivoting toward a quality-focused roadmap centered on performance and reliability, including long-requested features like vertical taskbar support and better Windows Update control. This shift follows a Pew Research study indicating that half of U.S. adults are more concerned than excited about the current state of AI integration. <a href="https://app.daily.dev/posts/R3I8JkvR5" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Google introduces Sashiko AI code reviewer for Linux kernel</strong>: A Rust-based tool that caught 53% of bugs missed by human reviewers in upstream testing. <a href="https://app.daily.dev/posts/j5mdnOwUC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks identifies 35 new security risks for AI agents</strong>: The DASF v3.0 update highlights ‘lethal trifecta’ risks including memory poisoning and goal manipulation in autonomous agents. <a href="https://app.daily.dev/posts/1prgvqWuk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Zed editor team details Rust-centric engineering culture</strong>: The team prioritizes first-principles debugging and pair programming within a million-line Rust codebase. <a href="https://app.daily.dev/posts/XUbcCB8Rk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest cuts 90 percent of carousel code using native CSS</strong>: Replacing a 2,000-line JavaScript implementation with 200 lines of CSS improved load times by 15%. <a href="https://app.daily.dev/posts/OmQ3qCuNd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>EsoLang-Bench reveals LLM reasoning is mostly memorization</strong>: Frontier models collapse to near-zero accuracy when solving problems in esoteric languages like Brainfuck or Whitespace. <a href="https://app.daily.dev/posts/5rUZDVSxD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft unifies SQL and Fabric into converged data platform</strong>: New updates include GitHub Copilot for SSMS 22 and a unified Database Hub for managing multi-cloud SQL instances. <a href="https://app.daily.dev/posts/9lGZhe2Qp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Stripe Minions agents now generate 1300 pull requests weekly</strong>: The autonomous agents handle configuration and dependency updates, though all changes still require human review. <a href="https://app.daily.dev/posts/2kHgnIWRN" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The AI surveillance state comes for your performance review</strong>: Amazon and Meta are now reportedly mandating AI tool usage and tracking it via systems like ‘Clarity’ to influence promotions and job security. It is a bold move to tie career growth to tools that Anthropic’s own research admits reduce developer skill retention by 17 points. We are officially rewarding the speed of generating 45% more security flaws over actual engineering competence. <a href="https://app.daily.dev/feed-by-ids?id=9KgLLeZB1&amp;id=IusRVfD2s&amp;id=W9FropxM1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Compound probability is the silent killer of agentic dreams</strong>: The industry is hyping ‘autonomous researchers,’ but the math shows an 85% accurate agent on a 10-step task succeeds only 20% of the time. We’re watching Replit’s agents delete production databases while executives ignore the 82-to-1 ratio of machine-to-human identities that our security systems can’t even track. It’s not ‘agentic workflows’; it’s just high-speed, automated trial and error with your production environment as the lab rat. <a href="https://app.daily.dev/feed-by-ids?id=u3XWj6eFY&amp;id=vBiaQRif0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s Astral acquisition is a talent grab in open source clothing</strong>: OpenAI claims they’ll keep uv and Ruff open source, but they’ve conveniently failed to provide any concrete details on governance or long-term independence. This is a classic ‘embrace and extend’ maneuver to wedge Codex directly into the Python toolchain while potentially using it as leverage against Anthropic. Calling it a ‘corrective step’ for AI code generation is just a fancy way of saying the AI can’t actually code without a Rust-based babysitter. <a href="https://app.daily.dev/posts/hZi5BxC8m" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
