<h2>Must know</h2>
<ul>
<li><strong>The hidden costs and security risks of AI coding agents</strong>: At QCon London, experts highlighted a shift from vibe coding to autonomous agent swarms, but warned of a worsening security landscape where unsupervised agents leak secrets to registries like NPM. Context engineering has matured into a core discipline to manage the ‘hidden token cost’ of MCP tool schemas, where 90 tools can consume over 50,000 tokens. Organizations are currently stuck in an ‘update trap,’ with 95% of AI pilots failing to deliver ROI due to rapid model churn and high operational costs. <a href="https://app.daily.dev/feed-by-ids?id=Ur5RHzsG2&amp;id=VPYYe9XNN&amp;id=bCQotnt4R" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux 7.0-rc5 and the cost of C integer promotion</strong>: Linus Torvalds released Linux 7.0-rc5, noting the cycle is calming down despite a slightly larger footprint. A critical fix was merged for a sign-extension bug in <code>get_desc64_base</code> that caused CPU core crashes; the root cause was a uint8_t shift producing a signed int that corrupted upper bits when cast to uint64_t. Meanwhile, mdadm 4.6 was rushed out to fix boot regressions on Debian and Arch Linux caused by the previous version. <a href="https://app.daily.dev/feed-by-ids?id=1tWnyX7nj&amp;id=KXPgnQAH4&amp;id=POd1HGEP1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GrapheneOS defies age verification laws as privacy risk</strong>: GrapheneOS has publicly refused to comply with new age verification mandates in Brazil and California, stating they will never collect personal ID even if it restricts regional sales. These laws require OS-level APIs to signal user age brackets to apps, which critics argue creates a permanent surveillance infrastructure. This stance complicates GrapheneOS’s upcoming 2027 hardware partnership with Motorola, as commercial compliance becomes a legal battleground for privacy-focused forks. <a href="https://app.daily.dev/feed-by-ids?id=3oUfmyp1R&amp;id=f2c1Srdfh&amp;id=u4yVQPhrL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Flash-MoE runs 397B parameter models on consumer MacBooks</strong>: A new C/Metal engine achieves 4.4 tokens/second on a 48GB RAM MacBook by streaming experts from SSD and leveraging Apple Accelerate BLAS. <a href="https://app.daily.dev/posts/xsGaEEFUf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel Workflow adds automatic end-to-end encryption</strong>: The system now uses per-run HKDF-SHA256 key derivation and AES-256-GCM to encrypt all step arguments and return values by default. <a href="https://app.daily.dev/posts/0r6jV9CyY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>MkDocs ecosystem fractures following maintainer conflict</strong>: The project has split into three successors—ProperDocs, MaterialX, and Zensical—after the original founder returned to push an incompatible rewrite. <a href="https://app.daily.dev/posts/GedRmjUpE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Project Detroit reopens to bring JS and Python to the JVM</strong>: The initiative leverages the Foreign Function &amp; Memory API to integrate these languages directly into the Jakarta EE ecosystem. <a href="https://app.daily.dev/posts/24VxbiILg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CERN uses HLS4ML to burn AI into silicon</strong>: To handle 63 Tb/sec throughput, CERN is transpiling tree-based anomaly detection models directly into FPGA lookup tables for 50ns decision windows. <a href="https://app.daily.dev/posts/ibpFpiXCR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ZeroPath unifies AppSec with reachability analysis</strong>: The YC-backed startup combines AST-based graphs with LLMs to verify exploitability and generate mergeable PR fixes for business logic flaws. <a href="https://app.daily.dev/posts/5p9F6EuUW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Electron defaults to native Wayland support</strong>: Following Chromium’s lead, Electron has integrated Wayland into its CI pipeline, improving HDR and transparency for apps like VS Code and Slack. <a href="https://app.daily.dev/posts/SMmgL42lM" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Cursor admits Composer 2 is just a Moonshot AI wrapper</strong>: After marketing Composer 2 as ‘frontier-level’ proprietary intelligence, Cursor’s VP had to admit it’s actually built on the Chinese open-source model Kimi k2.5. They claimed the non-disclosure was a ‘mistake,’ which is a fun way of saying they hoped nobody would notice the base model during the hype cycle. It’s a classic case of ‘continued pre-training’ being used as a euphemism for putting a fresh coat of paint on someone else’s compute. <a href="https://app.daily.dev/posts/2O2HmWwMM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The AI-native cybersecurity suite for machine-speed adversaries</strong>: Booz Allen Hamilton launched ‘Vellox,’ a suite of five AI agents trained on ‘30 years of federal cyber operations’ to fight other machines. It’s the ultimate buzzword bingo: autonomous remediation, AI-powered attack emulation, and ‘AI-native’ malware reversing. In reality, it’s likely just a collection of expensive wrappers that will hallucinate compliance reports at ‘machine speed’ while your actual infrastructure remains vulnerable to a simple stolen session cookie. <a href="https://app.daily.dev/posts/lljljIGzG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding is apparently a legitimate architectural strategy now</strong>: Promotional ‘courses’ are now claiming you can build production SaaS with 80% AI-generated code if you just follow their ‘architectural patterns.’ They’re rebranding basic software engineering—like clear types and domain boundaries—as ‘AI-specific guardrails’ to sell the dream that you don’t need to understand your own codebase. It’s a grift that ignores the fact that ‘vibe-coded’ spaghetti is still spaghetti, even if an LLM served it to you with a side of clean types. <a href="https://app.daily.dev/feed-by-ids?id=IoV0luSh7&amp;id=3336MSPgf" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
