<h2>Must know</h2>
<ul>
<li><strong>CanisterWorm evolves into a decentralized npm nightmare</strong>: The CanisterWorm supply chain attack has escalated, with threat actor TeamPCP now using the Internet Computer Protocol (ICP) for its command-and-control infrastructure, making it nearly impossible to take down via traditional means. The worm spreads by stealing npm tokens through compromised GitHub Actions and automatically republishing itself to every package the victim can access. Security researchers have identified a persistent Linux backdoor installed via a ‘pgmon’ systemd service that you should audit for immediately. <a href="https://app.daily.dev/posts/nKe1S4RDg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CERN proves tree models beat deep learning for high speed physics</strong>: In a refreshing reality check for AI scaling, CERN researchers found that aggressively quantized tree-based models outperform deep learning for processing the Large Hadron Collider’s 40,000 exabytes of annual data. Using a custom transpiler called HLS4ML, they burn these models directly into FPGA and ASIC silicon to make sub-50 nanosecond filtering decisions. This architecture is being pushed to the limit as they prepare for a throughput increase from 4 Tb/sec to 63 Tb/sec. <a href="https://app.daily.dev/posts/HLSLTGctL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The quest for a post Git version control system</strong>: BitTorrent creator Bram Cohen has released Manyana, a proof-of-concept for CRDT-based version control that aims to eliminate the concept of a ‘failed merge.’ By using a ‘weave’ history structure and guaranteeing that conflicts are surfaced as annotations rather than blocking errors, Manyana attempts to fix the long-standing UX hurdles of the DAG-based model. While still experimental, it represents a serious technical attempt to modernize how we handle distributed state in source code. <a href="https://app.daily.dev/posts/ErDrcgZ9t" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>ZeroPath brings reachability analysis to AI security fixes</strong>: This YC S24 startup uses AST-based graphs and LLMs to verify if vulnerabilities are actually exploitable before nagging developers with PR-level fixes. <a href="https://app.daily.dev/posts/5p9F6EuUW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel fix for catastrophic CPU lockups merged</strong>: A subtle C sign-extension bug in KVM selftests that caused multi-core crashes was identified and patched by a developer building a Type-2 hypervisor. <a href="https://app.daily.dev/posts/KXPgnQAH4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel Workflow adds automatic end to end encryption</strong>: The platform now uses AES-256-GCM with unique per-deployment keys to encrypt all step arguments and hook payloads by default. <a href="https://app.daily.dev/posts/0r6jV9CyY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Temper language targets universal library portability</strong>: Founded by a former Google security lead, Temper is designed from the ground up to transpile into Java, JavaScript, Python, and C# from a single codebase. <a href="https://app.daily.dev/posts/y7ODiLHuf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Floci emerges as a lightweight LocalStack alternative</strong>: As LocalStack sunsets its free tier, this open-source AWS emulator offers a 90MB Docker image that supports over 20 services with no auth required. <a href="https://app.daily.dev/posts/hbh0eKAmA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cilium hits ten years and sixty percent market share</strong>: The eBPF-based networking project is now the de facto data plane for massive AI clusters at Microsoft and Google. <a href="https://app.daily.dev/posts/rtti5mtPR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flash MoE runs massive models on consumer MacBooks</strong>: A new C/Metal engine can run the 397B parameter Qwen model at 4.4 tokens/second on a 48GB RAM laptop by streaming experts from SSD. <a href="https://app.daily.dev/posts/xsGaEEFUf" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Nvidia wants to pay your mortgage in AI tokens</strong>: Jensen Huang suggested at GTC that engineers should receive half their base salary in ‘AI tokens,’ a move critics rightly identify as a way to inflate compensation packages without spending actual cash or equity. These tokens don’t vest, don’t appreciate, and certainly won’t help you in a salary negotiation at your next job. It’s a transparent attempt to turn high-end engineering talent into captive users of Nvidia’s own compute ecosystem. <a href="https://app.daily.dev/posts/03LaAXXJF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Elon Musk’s Terafab is the new Full Self Driving</strong>: Musk announced ‘Terafab,’ a chip manufacturing facility intended to produce a terawatt of computing power for space, despite having zero experience in semiconductor fabrication. Given the track record of ‘Solar Roofs’ and ‘Cybercab’ timelines, industry observers are treating this as another high-altitude hype cycle designed to distract from Tesla’s projected 13% decline in smartphone-adjacent markets. Building a fab is slightly harder than tweeting about one. <a href="https://app.daily.dev/posts/qNbywR4ri" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The H&amp;R Block TLS backdoor special</strong>: In a masterclass of ‘security by incompetence,’ H&amp;R Block’s 2025 tax software installs a root CA certificate and its private key directly into the Windows trusted store. This effectively creates a permanent man-in-the-middle backdoor on user machines that persists even after the software is uninstalled. Despite being called out, the company has yet to issue a fix, proving once again that ‘enterprise grade’ is often a synonym for ‘dangerously negligent.’ <a href="https://app.daily.dev/posts/6dpZ7b6RS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
