<h2>Must know</h2>
<ul>
<li><strong>CanisterWorm hits npm via compromised GitHub Actions</strong>: A self-spreading worm named CanisterWorm is currently infecting the npm ecosystem by stealing tokens from developers using a compromised Trivy GitHub Actions workflow. Once a package is infected, it installs a persistent Linux backdoor and automatically republishes itself to every package the victim has write access to. Security researchers note the Command and Control infrastructure is hosted on the decentralized Internet Computer Protocol, making it nearly impossible to take down through traditional means. <a href="https://app.daily.dev/posts/nKe1S4RDg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CERN bypasses deep learning for on-chip FPGAs</strong>: To handle a massive jump in data throughput to 63 Tb/sec, CERN is burning anomaly-detection algorithms directly into FPGA and ASIC silicon using the HLS4ML transpiler. Their research found that aggressively quantized tree-based models actually outperform deep learning for structured sensor data while meeting a strict 50-nanosecond decision window. This move highlights a growing shift toward specialized, low-latency physical AI over general-purpose LLM architectures for high-stakes engineering. <a href="https://app.daily.dev/posts/HLSLTGctL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Agentic Platform Engineering pattern emerges</strong>: A new architectural proposal suggests treating AI agent configurations as versioned infrastructure, using layered Markdown files and symlinks to manage context efficiency. This ‘Agentic Platform Engineering’ approach aims to move away from ad-hoc agent setups toward a centralized, scalable distribution model compatible with the Model Context Protocol. By scoping instructions to specific filesystem directories, developers can significantly reduce token waste and improve agent reliability across large-scale enterprise environments. <a href="https://app.daily.dev/posts/qiDJTjrKj" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Vercel Workflow adds automatic E2E encryption</strong>: New deployments now feature per-run key derivation via HKDF-SHA256 and AES-256-GCM for all step arguments and payloads. <a href="https://app.daily.dev/posts/0r6jV9CyY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Manyana introduces CRDT based version control</strong>: BitTorrent creator Bram Cohen released a proof-of-concept that guarantees merges never fail by using informative annotations instead of blocking conflicts. <a href="https://app.daily.dev/posts/ErDrcgZ9t" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flash MoE runs 397B models on MacBooks</strong>: A new C/Metal engine achieves 4.4 tokens/second on 48GB RAM by streaming active experts directly from SSD with parallel pread calls. <a href="https://app.daily.dev/posts/xsGaEEFUf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ZeroPath unifies appsec with AI reachability</strong>: The YC S24 startup combines AST-based program analysis with LLMs to verify exploitability and generate mergeable PR fixes for vulnerabilities. <a href="https://app.daily.dev/posts/5p9F6EuUW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Floci offers a lightweight LocalStack alternative</strong>: This open-source AWS emulator starts in 24ms and supports 20+ services without requiring an auth token or paid tier. <a href="https://app.daily.dev/posts/hbh0eKAmA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel fix for KVM selftests</strong>: A critical sign-extension bug causing CPU crashes was fixed by casting fields to uint64_t before shifting in the get_desc64_base helper. <a href="https://app.daily.dev/posts/KXPgnQAH4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Appwrite Arena benchmarks LLM dev knowledge</strong>: A new open-source benchmark evaluates models on their understanding of SDKs and APIs, with GPT-5.4 currently leading when provided with skill files. <a href="https://app.daily.dev/posts/Iisw50c6I" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Nvidia wants to pay you in tokens</strong>: Jensen Huang is floating the idea of giving engineers AI tokens worth half their salary, which is a fantastic way to inflate compensation packages with funny money that doesn’t vest or pay rent. It’s essentially a high-tech version of company scrip that pressures devs to work at ‘superhuman’ rates just to justify their own budget. If you can’t buy a house with a GPU credit, it’s not a raise; it’s an expense account masquerading as equity. <a href="https://app.daily.dev/posts/03LaAXXJF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The smartphone is dead again</strong>: Amazon is reportedly building an AI-native ‘Transformer’ phone to eliminate app stores, apparently having learned nothing from the Fire Phone or the recent graveyard of AI pins and rabbits. Betting on a minimalist ‘dumbphone’ in a market projected to decline 13% is a bold strategy for a company whose primary AI interface is a glorified kitchen timer. Expect this to be a very expensive way to remind everyone that people actually like having apps that work. <a href="https://app.daily.dev/posts/qNbywR4ri" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Atomic architecture and the npm bloat crisis</strong>: We are still dealing with ‘atomic architecture’ where developers import an entire npm package just to check if a value is an array. This obsession with trivial one-liners has created a dependency hell of legacy polyfills and supply chain risks that serve no purpose in 2026. If your ‘modern’ stack requires 400 packages to perform basic logic available in ES6, you’re not an architect; you’re a digital hoarder. <a href="https://app.daily.dev/posts/bfsLARiuR" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
