<h2>Must know</h2>
<ul>
<li><strong>CanisterWorm npm supply chain attack escalates</strong>: A self-spreading worm named CanisterWorm is targeting Linux-based npm developers by stealing tokens via compromised GitHub Actions and installing a persistent Python backdoor. The threat actor group TeamPCP is using the decentralized Internet Computer Protocol for its C2 infrastructure, making the operation nearly impossible to take down through traditional means. Security researchers at Socket recommend auditing for a ‘pgmon’ systemd service and immediately rotating all npm credentials if infected. <a href="https://app.daily.dev/posts/nKe1S4RDg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CERN bypasses deep learning for FPGA based tree models</strong>: To handle the massive 63 Tb/sec throughput of the High Luminosity LHC upgrade, CERN is burning tree-based anomaly detection algorithms directly into FPGA and ASIC silicon using the HLS4ML transpiler. Their research found that aggressively quantized tree models outperform deep learning for structured tabular data while operating within a strict 50-nanosecond decision window. This hardware-level optimization allows them to discard 99.7% of collision data on-chip before it ever hits a traditional server. <a href="https://app.daily.dev/posts/HLSLTGctL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel Workflow adds automatic end to end encryption</strong>: Vercel has introduced mandatory E2EE for all workflow data, including step arguments and hook payloads, using unique per-deployment keys derived via HKDF-SHA256. Decryption is strictly limited to the Web Crypto API or CLI with all events logged, aiming to mitigate the risk of data exposure in serverless environments. This move sets a high bar for stateful serverless platforms where sensitive intermediate data often sits unencrypted in provider databases. <a href="https://app.daily.dev/posts/0r6jV9CyY" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Manyana introduces CRDT based version control</strong>: BitTorrent creator Bram Cohen released a proof-of-concept for version control that uses CRDTs to ensure merges never fail and history remains permanent. <a href="https://app.daily.dev/posts/ErDrcgZ9t" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ZeroPath brings AI native vulnerability remediation</strong>: This YC S24 startup combines program analysis with LLMs to not just find bugs, but verify exploitability and generate mergeable PR fixes. <a href="https://app.daily.dev/posts/5p9F6EuUW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Aurora DSQL expands PostgreSQL compatibility</strong>: AWS added identity columns, sequence objects, and a browser-based playground to its serverless distributed database to close the gap with standard Postgres. <a href="https://app.daily.dev/posts/Un5GpVc7x" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Temper language targets multi runtime translation</strong>: A new language designed by a former Google security engineer allows writing libraries once and compiling them to Java, JavaScript, Python, and C#. <a href="https://app.daily.dev/posts/y7ODiLHuf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Floci emerges as a LocalStack alternative</strong>: A lightweight, free AWS emulator that starts in 24ms and supports 20+ services, positioned for users fleeing LocalStack’s sunsetting free tier. <a href="https://app.daily.dev/posts/hbh0eKAmA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust view types proposal targets borrow checker pain</strong>: A new RFC suggests ‘view types’ to allow methods to declare specific field access, solving common borrow conflicts without runtime overhead. <a href="https://app.daily.dev/posts/jjK8lA3uk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cilium marks 10 years with 60 percent CNI share</strong>: The eBPF-based networking project is now being positioned as the primary data plane for massive AI training clusters at Google and Microsoft. <a href="https://app.daily.dev/posts/rtti5mtPR" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Nvidia AI tokens are the new company scrip</strong>: Jensen Huang is suggesting engineers take half their salary in ‘AI tokens,’ a move critics correctly identify as a way to inflate compensation packages without spending actual cash or equity. These tokens don’t vest, don’t appreciate, and certainly won’t help you in your next salary negotiation. It’s a brilliant way to turn high-end engineering talent into literal sharecroppers for the GPU mines. <a href="https://app.daily.dev/posts/03LaAXXJF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The Amazon Transformer AI phone fantasy</strong>: Amazon is reportedly building an AI-native smartphone to ‘eliminate app stores,’ apparently forgetting the Fire Phone’s spectacular cratering. Launching a niche hardware device into a market projected to decline 13% while competing with Apple and Samsung is a bold strategy for a company that just laid off thousands in its Alexa division. Expect this to join the Humane Pin and Rabbit R1 in the ‘expensive paperweight’ hall of fame by 2027. <a href="https://app.daily.dev/posts/ibpFpiXCR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Elon Musk’s Terafab semiconductor pipe dream</strong>: Musk announced ‘Terafab,’ a chip manufacturing facility in Austin, despite having zero experience in the most complex manufacturing process on Earth. Claiming he’ll produce chips for ‘terawatts of power in space’ is classic Musk hype designed to distract from Tesla’s aging lineup. Building a fab takes a decade and tens of billions; announcing one without a timeline or a partner is just noise for the fanboys. <a href="https://app.daily.dev/posts/qNbywR4ri" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
