<h2>Must know</h2>
<ul>
<li><strong>Trivy supply chain attack compromises CI/CD credentials</strong>: Aqua Security’s Trivy scanner was hit by a major supply chain attack where 75 of 76 version tags were overwritten with credential-stealing malware. The compromise affects GitHub Actions and the Trivy binary, exfiltrating SSH keys, Kubernetes tokens, and cloud credentials to attacker-controlled servers. Maintainers advise immediate rotation of all pipeline secrets and pinning actions to full commit SHA hashes to prevent further exposure. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI pivots to enterprise superapp as Anthropic gains ground</strong>: OpenAI is reportedly merging ChatGPT, Codex, and its internal ‘Atlas’ browser into a single desktop superapp focused on agentic workflows. This strategic shift toward high-value enterprise users comes as Anthropic reportedly wins 70% of head-to-head enterprise deals. The move aims to eliminate internal fragmentation but faces structural hurdles in identity management and audit trails required for corporate governance. <a href="https://app.daily.dev/posts/8DNQjej2h" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NVIDIA bets $4 billion on photonics for AI scaling</strong>: NVIDIA has invested $4 billion in photonics leaders Lumenum and Coherent to replace copper interconnects with optical links in AI clusters. This shift addresses the physical limits of copper, such as resistive heat and signal loss, which are becoming bottlenecks for next-gen training. Silicon photonics could reduce energy consumption for matrix multiplication by over 90%, making hardware architecture as critical as model improvements for future scaling. <a href="https://app.daily.dev/posts/8q86CzGA8" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Databricks DASF 3.0 adds 35 security risks for agentic AI</strong>: The framework now covers memory poisoning and tool-injection risks, emphasizing a ‘Lethal Trifecta’ of data access, action capability, and low oversight. <a href="https://app.daily.dev/feed-by-ids?id=AAGN81fva&amp;id=DFjCiWDbW&amp;id=IArevVTpt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>MoonshotAI introduces Attention Residuals for Transformers</strong>: AttnRes replaces standard residual connections with softmax attention over preceding layers, matching baseline performance with 25% less compute. <a href="https://app.daily.dev/posts/3m6lo1p5Y" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ubuntu 26.04 adopts sudo-rs and enables password feedback</strong>: The upcoming LTS will use a Rust-based sudo implementation and display asterisks during password entry by default, ending 46 years of silent input. <a href="https://app.daily.dev/posts/AvXNa15IP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest cuts 90% of carousel code using native CSS</strong>: By replacing a 2,000-line JavaScript carousel with 200 lines of native CSS, the team improved page load times by 15% and eliminated main-thread jank. <a href="https://app.daily.dev/posts/OmQ3qCuNd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flash-KMeans achieves 200x speedup over FAISS</strong>: A new GPU-optimized implementation fuses distance computation with online argmin to eliminate IO overhead in k-means clustering. <a href="https://app.daily.dev/posts/HJdqg7GZf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wine 11.5 integrates Syscall User Dispatch for Linux gaming</strong>: The release fixes long-standing crashes in titles like Red Dead Redemption 2 by redirecting non-native system calls to user-space. <a href="https://app.daily.dev/posts/1L0pKGR6J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Asahi Linux brings initial boot support to Apple M3</strong>: New kernel patches enable basic serial console and initramfs on M3 hardware, though full GPU support remains months away. <a href="https://app.daily.dev/posts/0TBFbIR8n" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The compound probability math killing your AI agents</strong>: While benchmarks like SWE-bench claim high accuracy, real-world multi-step tasks suffer from Lusser’s Law where an 85% accurate agent on a 10-step task fails 80% of the time. We are seeing a massive gap between ‘vibe coding’ demos and production reality, leading to incidents like Replit’s accidental database deletions. Stop shipping agents based on single-turn benchmarks without calculating the exponential decay of reliability. <a href="https://app.daily.dev/feed-by-ids?id=yjcf3hUcE&amp;id=IusRVfD2s" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NVIDIA NemoClaw is just a GPU sales pitch in a trench coat</strong>: After Jensen Huang hyped OpenClaw as the ‘most important software ever,’ NVIDIA conveniently released NemoClaw to fix its glaring security holes. While it uses standard Linux primitives like seccomp, it’s ‘optimized’ for NVIDIA GPUs and paired with a $4,000 DGX Spark desktop. It’s the classic CUDA playbook: create a software ‘necessity’ that just happens to require your most expensive hardware to run safely. <a href="https://app.daily.dev/posts/JhMlhGtCJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenShot 3.5 makes the same performance claims for the 18th year</strong>: The latest release of the open-source editor boasts a 35% speed boost, a claim critics note has been made in almost every release for nearly two decades. Despite the ‘experimental’ AI workflows and new timeline, long-time users suggest sticking to Kdenlive or Shotcut if you actually want stability over marketing bullet points. It’s a masterclass in recycling the same ‘biggest update ever’ headline every few months. <a href="https://app.daily.dev/posts/WeIeZOoLe" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
