<h2>Must know</h2>
<ul>
<li><strong>CanisterWorm hits npm via compromised GitHub Actions</strong>: A self-spreading worm named CanisterWorm is currently infecting the npm ecosystem by stealing tokens from developers using a compromised Trivy GitHub Actions workflow. Once a package is infected, it installs a persistent Linux backdoor and automatically republishes itself to every package the victim has write access to. Security researchers note the Command and Control infrastructure is hosted on the Internet Computer Protocol (ICP) blockchain, making it nearly impossible to take down through traditional registrar or IP blocking. <a href="https://app.daily.dev/posts/nKe1S4RDg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bram Cohen unveils CRDT based version control</strong>: The creator of BitTorrent has released Manyana, a proof-of-concept version control system that uses Conflict-free Replicated Data Types to ensure merges never fail. Unlike Git, which forces users to resolve opaque merge conflicts before proceeding, Manyana surfaces conflicts as informative annotations within the code. The system uses a ‘weave’ history structure and a DAG-based rebase mechanism that preserves full history, potentially solving long-standing UX hurdles in distributed team workflows. <a href="https://app.daily.dev/posts/ErDrcgZ9t" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>H&amp;R Block software installs permanent TLS backdoor</strong>: The 2025 edition of H&amp;R Block Business tax software is reportedly installing a root CA certificate and its private key into the Windows trusted root store. This ‘WK ATX ServerHost 2024’ certificate enables trivial man-in-the-middle attacks on affected systems and remains active even after the software is uninstalled. Despite public disclosure, the company has yet to issue a fix for this significant security regression. <a href="https://app.daily.dev/feed-by-ids?id=0r6jV9CyY&amp;id=2h83ZvZOg&amp;id=5p9F6EuUW&amp;id=6dpZ7b6RS&amp;id=BuBHyicZm&amp;id=VfmEYbEde&amp;id=WlDoYxg0H&amp;id=fgbYMqxZM&amp;id=kDlR914eI&amp;id=nO5sBkcvm" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Vercel Workflow adds automatic end to end encryption</strong>: The new system uses AES-256-GCM with unique per-deployment keys and HKDF-SHA256 derivation to secure all step arguments and payloads. <a href="https://app.daily.dev/posts/0r6jV9CyY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel fix for catastrophic KVM sign extension bug</strong>: A developer discovered that incorrect integer promotion in a C helper was causing CPU core crashes; the fix involves explicit uint64_t casting before bit-shifting. <a href="https://app.daily.dev/posts/KXPgnQAH4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Temper language targets multi runtime library portability</strong>: Founded by a former Google security lead, Temper is designed from scratch to transpile into Java, JavaScript, Python, and C# with a single codebase. <a href="https://app.daily.dev/posts/y7ODiLHuf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CERN uses HLS4ML to burn AI into FPGA silicon</strong>: To handle 63 Tb/sec throughput, CERN is transpiling tree-based models directly into hardware for 50-nanosecond anomaly detection. <a href="https://app.daily.dev/posts/HLSLTGctL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NixOS gains traction for AI agent environments</strong>: The declarative nature of Nix is being leveraged to allow LLM coding agents to pull exact tool versions into isolated environments without host mutation. <a href="https://app.daily.dev/posts/on18fcwiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Appwrite Arena benchmarks LLM documentation knowledge</strong>: A new open-source benchmark evaluates models across 191 questions to see how well they actually understand specific API and SDK nuances. <a href="https://app.daily.dev/posts/Iisw50c6I" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Zig refactor ditches metaprogramming for explicit builders</strong>: A notable D-Bus library refactor argues that using metaprogramming for serialization is a ‘cool factor’ trap that complicates debugging and maintenance. <a href="https://app.daily.dev/posts/jI9iYMae2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Nvidia wants to pay engineers in AI tokens</strong>: Jensen Huang is floating the idea of giving engineers ‘AI tokens’ worth half their salary, which is just a creative way to inflate compensation packages with non-vesting, non-appreciating company scrip. Critics rightly point out these tokens carry zero value in salary negotiations and are essentially a high-tech version of the company store. It’s a transparent attempt to subsidize R&amp;D costs by making employees pay for the compute they use to do their jobs. <a href="https://app.daily.dev/feed-by-ids?id=03LaAXXJF&amp;id=2O2HmWwMM&amp;id=3336MSPgf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The Amazon Transformer smartphone fantasy</strong>: Amazon is reportedly trying to build an ‘AI-native’ smartphone to eliminate app stores, apparently forgetting the Fire Phone disaster and the recent graveyard of AI hardware like the Rabbit R1. Betting on a 13% declining smartphone market with a ‘minimalist’ device is a bold move for a company that still hasn’t made Alexa profitable. Expect this to be another ZeroOne group project that ends up as a discounted ‘dumbphone’ in a Woot clearance sale. <a href="https://app.daily.dev/feed-by-ids?id=HLSLTGctL&amp;id=ibpFpiXCR&amp;id=qNbywR4ri" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Delve accused of fabricating compliance evidence</strong>: YC-backed startup Delve is facing allegations that it generates ‘template’ outputs to fake HIPAA and GDPR compliance for its customers. While the company claims these are just helpful starting points, whistleblowers suggest they are essentially selling a ‘get out of jail free’ card that actually increases legal liability. It turns out that automating trust is hard when your primary product is a hallucinating compliance engine with exposed employee background checks. <a href="https://app.daily.dev/feed-by-ids?id=0r6jV9CyY&amp;id=2h83ZvZOg" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
