<h2>Must know</h2>
<ul>
<li><strong>CanisterWorm targets npm via compromised GitHub Actions</strong>: A self-spreading worm named CanisterWorm is currently infecting the npm ecosystem by stealing tokens from developers using compromised Trivy workflows. Once active, it installs a persistent Linux backdoor via systemd and uses the decentralized Internet Computer Protocol for its command-and-control infrastructure, making it resistant to traditional takedowns. Security researchers at TeamPCP report over 50 packages are already affected, requiring immediate rotation of all npm credentials and a search for ‘pgmon’ services. <a href="https://app.daily.dev/posts/nKe1S4RDg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Aurora DSQL expands PostgreSQL compatibility and tooling</strong>: AWS has updated its serverless distributed database, Aurora DSQL, adding support for identity columns and sequence objects to better align with standard PostgreSQL. The release includes new open-source driver connectors for Go (pgx) and Python (asyncpg), alongside integrations with migration tools like Flyway and Prisma. While the browser-based playground simplifies testing, InfoQ notes that developers must still navigate trade-offs regarding optimistic concurrency and the lack of foreign key support. <a href="https://app.daily.dev/posts/Un5GpVc7x" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cilium marks a decade with eBPF performance gains</strong>: Celebrating its 10th anniversary, Cilium 1.19 has introduced ztunnel mTLS integration and stable Multi-Pool IPAM to its cloud-native networking stack. Production case studies from OVHcloud and Zynga highlight the elimination of conntrack scaling bottlenecks by replacing kube-proxy with eBPF-based load balancing. The project is increasingly positioned as the standard data plane for large-scale AI training clusters at Microsoft and Google. <a href="https://app.daily.dev/posts/rtti5mtPR" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Floci emerges as a lightweight LocalStack alternative</strong>: A new open-source AWS emulator starts in 24ms with 13MB of memory, targeting teams affected by LocalStack’s sunsetting free tier. <a href="https://app.daily.dev/posts/hbh0eKAmA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Manyana introduces CRDT based version control</strong>: BitTorrent creator Bram Cohen released a proof-of-concept for a version control system that guarantees merges never fail by using informative annotations. <a href="https://app.daily.dev/posts/ErDrcgZ9t" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel Workflow adds end to end encryption</strong>: The platform now automatically encrypts all step arguments and hook payloads using AES-256-GCM with unique keys per deployment. <a href="https://app.daily.dev/posts/0r6jV9CyY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel optimizations boost MongoDB and networking</strong>: Recent updates including MGLRU and idle CPU work stealing have delivered up to 30% performance gains for MongoDB workloads. <a href="https://app.daily.dev/posts/QlGhzzwwW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ZeroPath automates vulnerability exploitability verification</strong>: This YC-backed startup combines program analysis with LLMs to filter out SAST noise and generate mergeable security fixes. <a href="https://app.daily.dev/posts/5p9F6EuUW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flash MoE runs 397B parameter models on consumer hardware</strong>: A new C/Metal engine achieves 4.4 tokens per second on a MacBook Pro by streaming active experts directly from SSD. <a href="https://app.daily.dev/posts/xsGaEEFUf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>H&amp;R Block software installs a permanent TLS backdoor</strong>: The 2025 business tax suite adds a root CA with its private key to the Windows store, enabling MITM attacks even after uninstallation. <a href="https://app.daily.dev/posts/fgbYMqxZM" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The AI token salary inflation scheme</strong>: Jensen Huang is floating the idea of paying engineers in ‘AI tokens’ worth half their base salary, which is just a fancy way of saying ‘we found a way to not pay you in real money.’ These tokens don’t vest, don’t appreciate, and certainly won’t help you negotiate your next mortgage. It’s a masterclass in corporate gaslighting, rebranding a budget-cutting measure as a futuristic perk for the ‘superhuman’ engineer. <a href="https://app.daily.dev/posts/3336MSPgf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Amazon’s Transformer phone is a solution looking for a problem</strong>: Amazon is reportedly building an AI-native smartphone to ‘eliminate app stores,’ apparently forgetting the Fire Phone’s spectacular cratering. In a market where smartphone shipments are tanking and dedicated AI hardware like the Rabbit R1 is already e-waste, Amazon thinks a minimalist ‘dumbphone’ with Alexa is the breakthrough we’ve been waiting for. It’s a classic case of a tech giant throwing money at a trend because they’re terrified of being left behind by Apple and Samsung. <a href="https://app.daily.dev/posts/qNbywR4ri" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The compliance fabrication scandal at Delve</strong>: YC-backed startup Delve is facing accusations that it essentially ‘hallucinates’ compliance evidence for customers needing HIPAA and GDPR certification. While the company claims its outputs are just ‘templates,’ whistleblowers suggest they’re selling a shortcut to security that leaves customers legally exposed. It turns out that automating trust with an LLM is a great way to scale liability, not security. <a href="https://app.daily.dev/posts/WlDoYxg0H" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
