<h2>Must know</h2>
<ul>
<li><strong>Massive supply chain attack hits Trivy and LiteLLM</strong>: A coordinated campaign by threat group TeamPCP has compromised the Trivy vulnerability scanner and LiteLLM PyPI packages, infecting over 1,000 cloud environments. The malware exfiltrates AWS/GCP credentials, SSH keys, and Kubernetes configs, with Mandiant warning the victim count could reach 10,000. If you used LiteLLM versions 1.82.7 or 1.82.8, rotate all environment secrets immediately. <a href="https://app.daily.dev/feed-by-ids?id=kjJd6k0JC&amp;id=I6Q0A8ukt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DeepSeek unveils Engram architecture for factual memory</strong>: DeepSeek researchers introduced Engram, a third fundamental transformer component alongside attention and feed-forward networks that acts as a conditional memory lookup table. By storing multi-token patterns in a hashed table, it improves factual knowledge retrieval by up to 70% without increasing per-token compute. This architecture is expected to anchor the upcoming DeepSeek V4, potentially making high-reasoning models cheaper to run locally. <a href="https://app.daily.dev/posts/lk5ZjBxyb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI kills Sora to focus on the Spud super app</strong>: In a surprising strategic pivot, OpenAI is shutting down its Sora video generation tool across all platforms to refocus compute on core productivity and business tools. CEO Sam Altman cited a need to eliminate “side quests” in favor of a new foundational model codenamed Spud, which aims to consolidate desktop and browser experiences into a single application. This move cedes the AI video market to competitors like Google’s Veo and various Chinese labs. <a href="https://app.daily.dev/posts/55QkjBkbg" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Anthropic adds auto mode to Claude Code</strong>: A new permissions classifier automatically approves safe tool calls while blocking destructive actions like mass deletions. <a href="https://app.daily.dev/posts/Hgz3is1rZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wine 11 brings massive Linux gaming gains</strong>: The new NTSYNC kernel driver implements Windows synchronization primitives directly in Linux, boosting some benchmarks from 110 to 860 FPS. <a href="https://app.daily.dev/posts/ojJBzn8RU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CNCF adopts llm-d for Kubernetes inference</strong>: The new sandbox project enables disaggregated prefill/decode phases and KV-cache-aware routing for production LLM workloads. <a href="https://app.daily.dev/posts/tdsbXMmJT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Arm launches AGI CPU for agentic data centers</strong>: The Neoverse V3-based chip features 136 cores and PCIe Gen 6 support, specifically optimized for high-memory agentic AI tasks. <a href="https://app.daily.dev/posts/S5lBW0zAU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Safari 26.4 introduces CSS Grid Lanes</strong>: The update adds masonry-style layouts via native CSS and implements WebTransport for low-latency QUIC communication. <a href="https://app.daily.dev/posts/vXvtsrMcB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel acquires new.website for v0 integration</strong>: The move aims to make forms, databases, and SEO primitives feel like native, agent-aware components within the v0 ecosystem. <a href="https://app.daily.dev/posts/TXo5OfLTR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Salesforce automates release approvals with Luminary</strong>: A new deterministic engine replaces manual Slack-based sign-offs, reducing deployment latency from days to seconds. <a href="https://app.daily.dev/posts/3wqbfud3u" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The fight AI with AI marketing trap</strong>: Security vendors are aggressively pushing ‘AI-native security’ as a silver bullet, but experts like Danny at ThreatLocker point out that AI still can’t determine software intent. Most of these ‘autonomous’ defense systems are just glorified pattern matchers that fail at basic zero-trust principles. Stick to blocking untrusted code instead of hoping a second LLM will catch the first one’s hallucinations. <a href="https://app.daily.dev/feed-by-ids?id=f6diiN9F1&amp;id=TxvaKIk8l" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenClaw is a security dumpster fire</strong>: Despite racking up 247,000 GitHub stars in record time, the OpenClaw AI agent is being called out by Jentic for exposing 40,000 instances and leaking credentials. It turns out giving an experimental LLM wrapper full access to your APIs without a permission firewall is exactly as dangerous as it sounds. The hype cycle has once again prioritized ‘cool demos’ over basic data exfiltration protection. <a href="https://app.daily.dev/posts/SB6BM3WqC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Sensationalist architecture breakthroughs</strong>: While DeepSeek’s Engram is a legitimate technical step, the surrounding commentary claiming it ‘fixed one of the biggest problems with AI’ is pure clickbait. It’s a conditional memory lookup table, not a sentient brain upgrade. It helps with trivia and factual recall, but it won’t stop your model from confidently lying about things it hasn’t indexed in its hash table. <a href="https://app.daily.dev/posts/lk5ZjBxyb" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
