<h2>Must know</h2>
<ul>
<li><strong>CanisterWorm hits npm via compromised GitHub Actions</strong>: A self-spreading worm dubbed CanisterWorm is currently infecting the npm ecosystem by stealing tokens from developers using a compromised Trivy GitHub Actions workflow. Once a package is infected, it installs a persistent Linux backdoor and automatically republishes itself to every package the victim has write access to. Security researchers note the Command and Control infrastructure is hosted on the Internet Computer Protocol (ICP) blockchain, making it nearly impossible to take down through traditional means. <a href="https://app.daily.dev/posts/nKe1S4RDg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic launches Claude Code Channels and MCP integration</strong>: Anthropic has expanded its developer toolchain with Claude Code Channels, enabling direct interaction with its CLI via Telegram and Discord using the Model Context Protocol (MCP). This move directly competes with open-source alternatives like OpenClaw by providing a standardized way to connect AI agents to local and remote data sources. For staff engineers, this signals a shift toward treating agent context as versioned infrastructure rather than ad-hoc prompts. <a href="https://app.daily.dev/feed-by-ids?id=03LaAXXJF&amp;id=qiDJTjrKj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel Workflow adds automatic end to end encryption</strong>: Vercel has introduced native E2E encryption for its Workflow product, securing all step arguments, return values, and hook payloads using AES-256-GCM. Keys are derived per-run via HKDF-SHA256 and are unique to each deployment, with all decryption events strictly logged for auditing. This addresses a major hurdle for enterprise adoption of serverless orchestration where sensitive data often sits unencrypted in state stores. <a href="https://app.daily.dev/posts/0r6jV9CyY" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Manyana introduces CRDT based version control</strong>: BitTorrent creator Bram Cohen released a proof-of-concept for version control where merges never fail and conflicts are handled as non-blocking annotations. <a href="https://app.daily.dev/posts/ErDrcgZ9t" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ZeroPath brings AI native vulnerability remediation to RSAC</strong>: The YC S24 startup uses program analysis and LLMs to not just find bugs, but verify exploitability and generate mergeable PR fixes. <a href="https://app.daily.dev/posts/5p9F6EuUW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flash MoE runs 397B parameter models on MacBooks</strong>: A new C/Metal engine achieves 4.4 tokens/second on a 48GB RAM laptop by streaming experts from SSD using parallel pread calls. <a href="https://app.daily.dev/posts/xsGaEEFUf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Aurora DSQL expands with playground and agent skills</strong>: AWS added a zero-account playground and Kiro AI agent skills to its serverless distributed PostgreSQL-compatible database. <a href="https://app.daily.dev/posts/Un5GpVc7x" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Temper language targets multi runtime library distribution</strong>: Founded by a former Google security engineer, Temper is designed to compile a single codebase into Java, JavaScript, Python, and C#. <a href="https://app.daily.dev/posts/y7ODiLHuf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cilium hits 10 years with eBPF for AI clusters</strong>: The project now powers networking for major AI training clusters at Microsoft and Google, recently adding ztunnel mTLS integration. <a href="https://app.daily.dev/posts/rtti5mtPR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>H&amp;R Block software installs a permanent TLS backdoor</strong>: The 2025 business tax software adds a root CA with its private key to the Windows store, enabling MITM attacks even after uninstallation. <a href="https://app.daily.dev/posts/pYjW696nK" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Nvidia tokens are the new company scrip</strong>: Jensen Huang suggested at GTC that engineers should receive AI tokens worth half their salary, which is a fantastic way to inflate compensation packages with ‘currency’ that doesn’t vest, appreciate, or pay rent. It’s essentially a high-tech version of the company store, pressuring engineers to use the very tools that are supposedly making them obsolete. If you can’t give them equity that actually has value, just give them ‘vibe credits’ and call it a revolution. <a href="https://app.daily.dev/posts/03LaAXXJF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The AI smartphone graveyard welcomes Amazon</strong>: Amazon is reportedly working on ‘Transformer,’ an AI-powered smartphone that aims to eliminate app stores, because the world definitely needs another AI-native hardware failure. Following the footsteps of the Humane Pin and Rabbit R1, Amazon thinks it can disrupt Apple and Samsung during a 13% market decline with a device that likely just wraps Alexa in a new hallucination layer. It’s a bold move to try and ‘eliminate apps’ when your primary mobile success to date is a shopping app and a Kindle. <a href="https://app.daily.dev/posts/ibpFpiXCR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor omits its Chinese model foundation</strong>: Cursor launched Composer 2 to much fanfare, conveniently ‘forgetting’ to mention it’s built on Moonshot AI’s Kimi k2.5, a Chinese open-source model. Co-founder Aman Sanger called the omission a ‘mistake’ only after being called out, proving that even in the high-stakes world of AI coding assistants, the ‘vibe’ is often just a rebranded wrapper. It’s a classic move: take an existing model, add a slick UI, and hope nobody checks the authorized commercial partnership fine print. <a href="https://app.daily.dev/posts/03LaAXXJF" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
