<h2>Must know</h2>
<ul>
<li><strong>CanisterWorm hits npm via compromised GitHub Actions</strong>: A self-spreading worm named CanisterWorm is currently infecting the npm ecosystem by stealing tokens through compromised Trivy GitHub Actions workflows. According to security reports, the malware installs a persistent Linux backdoor and automatically republishes itself to every package the victim has access to. The Command and Control infrastructure is hosted on the decentralized Internet Computer Protocol, making it nearly impossible to take down through traditional means. <a href="https://app.daily.dev/posts/nKe1S4RDg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Britannica and Merriam-Webster sue OpenAI for copyright and hallucinations</strong>: The two reference giants have filed a major lawsuit against OpenAI, alleging the unauthorized use of nearly 100,000 articles for model training and RAG. Beyond copyright, the suit includes Lanham Act violations for “hallucinations” that the plaintiffs claim are being falsely attributed to their brands. This follows similar legal actions by the New York Times and signals a tightening legal noose around training data provenance. <a href="https://app.daily.dev/posts/03LaAXXJF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CERN bypasses deep learning for FPGA-based tree models</strong>: To handle a massive 63 Tb/sec data throughput, CERN researchers are burning tree-based anomaly detection models directly into ASIC and FPGA silicon using the HLS4ML transpiler. They found that aggressively quantized tree models outperform deep learning for their structured tabular data while meeting a strict 50-nanosecond decision window. This hardware-level optimization allows them to discard 99.7% of collision events on-chip before they ever hit a disk. <a href="https://app.daily.dev/posts/HLSLTGctL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Bram Cohen previews Manyana a CRDT-based version control system</strong>: The BitTorrent creator’s new proof-of-concept uses a weave history structure to ensure merges never fail, surfacing conflicts as annotations instead. <a href="https://app.daily.dev/posts/ErDrcgZ9t" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel Workflow adds automatic end-to-end encryption</strong>: The new system uses AES-256-GCM with unique keys per deployment to secure all step arguments, payloads, and stream data. <a href="https://app.daily.dev/posts/0r6jV9CyY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel work stealing yields 17 percent speedup</strong>: Recent kernel updates include idle CPU work stealing, MGLRU improvements for MongoDB, and a virtual swap layer redesign. <a href="https://app.daily.dev/posts/QlGhzzwwW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Temper language aims for universal multi-runtime translation</strong>: A new language from a former Google security engineer allows writing libraries once and compiling them natively to Java, JS, Python, and C#. <a href="https://app.daily.dev/posts/tmpi3HK2M" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>H&amp;R Block software installs a permanent TLS backdoor</strong>: The 2025 business tax suite adds a root CA certificate and private key to the Windows store, enabling MITM attacks even after uninstallation. <a href="https://app.daily.dev/posts/fgbYMqxZM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Appwrite Arena launches open-source LLM benchmarks</strong>: The new benchmark evaluates how well models like GPT-5.4 and Claude 4.6 handle specific SDK and API documentation context. <a href="https://app.daily.dev/posts/Iisw50c6I" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NixOS gains traction for LLM coding agent environments</strong>: The declarative nature of Nix allows AI agents to pull exact tool versions into isolated environments without mutating the host system. <a href="https://app.daily.dev/posts/on18fcwiv" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Nvidia wants to pay your salary in AI tokens</strong>: Jensen Huang suggested at GTC that engineers should receive AI tokens worth half their base salary, which is a fantastic way to inflate total comp without actually paying cash or equity. These tokens don’t vest, don’t appreciate, and are essentially company scrip for the GPU era. It’s a bold move to see if engineers will accept “superhuman productivity pressure” in exchange for digital coupons. <a href="https://app.daily.dev/posts/03LaAXXJF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Elon Musk’s Terafab is the new semiconductor vaporware</strong>: Musk announced a “Terafab” facility to build chips for Tesla and SpaceX, despite having zero experience in the most complex manufacturing process on Earth. The goal of producing a terawatt of computing power in space is classic Muskian distraction from the 13% decline in smartphone shipments and his lack of a fab partner. Expect this to arrive right around the same time as the coast-to-coast autonomous drive from 2017. <a href="https://app.daily.dev/posts/qNbywR4ri" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The JavaScript dependency bloat is a self-inflicted wound</strong>: We are still shipping polyfills for IE6 and atomic one-liner packages because the ecosystem is terrified of breaking a build from 2004. Tools like knip and e18e are finally calling out this “atomic architecture” nonsense where a single-line function becomes a supply chain risk. If your dependency tree looks like a fractal of 10-year-old technical debt, it’s not a feature, it’s a failure of basic engineering discipline. <a href="https://app.daily.dev/posts/bfsLARiuR" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
