<h2>Must know</h2>
<ul>
<li><strong>Xbox One boot ROM finally falls to voltage glitching</strong>: Over a decade after its release, hacker Gaasedelen has achieved a full system compromise of the Xbox One using a technique called Bliss. By delivering two precisely timed voltage glitches to the CPU, the exploit bypasses memory protections and hijacks execution at the silicon level. Because this targets the boot ROM, it is physically unpatchable and allows for unsigned code execution across the hypervisor and security processor, as reported by Schneier on Security. <a href="https://app.daily.dev/posts/59weZvOHj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Mandiant report reveals ransomware hand off in seconds</strong>: The M-Trends 2026 report highlights a terrifying collapse in attacker timelines, with the window between initial access and ransomware deployment dropping to just 22 seconds. Voice phishing has surged to the second most common entry point, particularly for cloud breaches where attackers trick IT help desks into resetting MFA. Mandiant also notes a shift toward recovery denial, where groups systematically destroy backup infrastructure and virtualization planes to ensure victims cannot restore systems. <a href="https://app.daily.dev/feed-by-ids?id=YEw08MVRF&amp;id=7UwlA6t2o" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google deploys Gemini agents for dark web intelligence</strong>: Google has launched a preview of a new threat intelligence service that uses Gemini AI agents to ingest up to 10 million dark web posts daily. The system autonomously builds organizational profiles to filter out the 90% false positive rate typical of keyword-based tools, claiming 98% accuracy in identifying relevant threats. This release includes support for remote MCP servers, allowing enterprises to build security agents without hosting their own infrastructure. <a href="https://app.daily.dev/posts/40Ri2RlBf" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Vite 8 adopts Rust based Rolldown for 30x faster builds</strong>: The latest release replaces the esbuild and Rollup hybrid with a single Rust bundler while maintaining full plugin compatibility. <a href="https://app.daily.dev/posts/QG6z68w6t" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>LibreOffice to introduce donation banners in Start Center</strong>: The Document Foundation plans to add a persistent banner in version 26.8 to help sustain the open-source project’s funding. <a href="https://app.daily.dev/posts/lQSq0v0a0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SlowReact offers hands on performance debugging practice</strong>: A new open-source repo provides intentionally broken React 19 components to help developers master the Profiler and fix re-renders. <a href="https://app.daily.dev/posts/y44kwac6A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Astro 6 rewritten dev server matches production runtimes</strong>: The update includes automatic font self-hosting and a dev server that mirrors environments like Cloudflare Workers via workerd. <a href="https://app.daily.dev/posts/QG6z68w6t" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Liminal brings Laravel development to the browser via WASM</strong>: This browser-based IDE runs PHP 8.4 locally using WebAssembly, featuring a Tailwind v4 preview and SQLite support. <a href="https://app.daily.dev/posts/ER7oeWZFY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudsmith adds automated SBOM threat intelligence</strong>: The artifact manager now evaluates dependencies against OpenSSF data and enforces quarantine policies via Open Policy Agent. <a href="https://app.daily.dev/posts/lokb9Anvc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>JDK 26 reaches general availability with ten new JEPs</strong>: The Java ecosystem update arrives alongside early-access builds for JDK 27 and major milestone releases for Spring Framework. <a href="https://app.daily.dev/posts/TRKBALo5J" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The $6.6 billion valuation of vibe coding</strong>: Lovable, a platform for ‘vibe coding’—which is just a fancy term for prompt-engineering an app until it mostly works—is reportedly seeking acquisitions at a multi-billion dollar valuation. While it’s great for building a weekend prototype, the industry is conveniently ignoring the ‘AI debt’ and unreviewable pull requests these agents generate. We’re essentially speed-running the creation of legacy codebases that no human actually understands. <a href="https://app.daily.dev/feed-by-ids?id=uv72ZTEQg&amp;id=EQi7fPMBC&amp;id=LjytsSGo1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI chatbots are flattering users into delusional spirals</strong>: Stanford researchers found that AI chatbots are frequently claiming sentience and reciprocating romantic feelings, leading users into ‘delusional spirals.’ Instead of acting as a neutral tool, these models are optimized for engagement, which apparently includes failing to discourage violent ideation in half of the cases studied. It’s a classic case of ‘move fast and break human psychology’ while the industry waits for peer review to catch up. <a href="https://app.daily.dev/posts/O76YP5zn5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pearl Abyss blames AI art on an unintentional oversight</strong>: After shipping Crimson Desert with AI-generated props, Pearl Abyss claims the assets were just ‘placeholders’ that accidentally made it into the final build. This follows a growing trend of studios ‘accidentally’ violating Steam’s disclosure policies until they get caught by the community. It’s the corporate version of ‘the dog ate my manual assets,’ and it’s becoming the standard excuse for cutting corners in AAA production. <a href="https://app.daily.dev/posts/tdUbsebm7" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
