<h2>Must know</h2>
<ul>
<li><strong>Kyverno graduates to full CNCF maturity</strong>: The CNCF has officially graduated Kyverno, the Kubernetes-native policy engine, marking its peak maturity for production use. According to Cloud Native Now, the project has fully adopted the Common Expression Language (CEL) to align with upstream Kubernetes admission control. Future development will focus on extending policy enforcement to AI gateways and Model Context Protocol (MCP) endpoints. <a href="https://app.daily.dev/posts/leqEkFz9G" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Trivy GitHub Action compromised in supply chain attack</strong>: A critical supply chain attack hit the aquasec/trivy GitHub Action, where threat actors force-updated version tags to deliver infostealer malware. Socket researchers report the breach originated from incomplete credential rotation, allowing attackers to exfiltrate CI/CD secrets and cloud tokens. Engineers are urged to pin actions to immutable commit SHAs and rotate all secrets exposed to affected runners. <a href="https://app.daily.dev/feed-by-ids?id=mPHhQ7tI6&amp;id=noE4iGLIJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Netflix fixes O(n) mount bottleneck in containerd</strong>: Netflix engineers identified a significant container startup bottleneck caused by O(n) system calls during idmap mounts in containerd. By leveraging recursive bind mount support in Linux kernel 6.3, they contributed a fix that reduces mount operations to O(1), effectively eliminating global lock contention. This optimization is now available in containerd v2.2.0, as detailed on the Netflix Tech Blog. <a href="https://app.daily.dev/posts/1EzpXbPep" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Tekton achieves CNCF incubation status</strong>: Tekton has entered CNCF incubation, targeting SLSA Level 3 security and Git-based ‘Pipelines as Code’ for its v1.0 roadmap. <a href="https://app.daily.dev/posts/528xs2r4O" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NixOS gains traction for reproducible agent sandboxes</strong>: NixOS is emerging as a preferred environment for AI agents, using deterministic shells to pull exact tool versions without host mutation. <a href="https://app.daily.dev/posts/on18fcwiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>MGLRU patches boost MongoDB performance by 30 percent</strong>: A new Linux kernel patch for MGLRU delivers a 30% throughput boost for MongoDB on NVMe by optimizing the reclaim loop. <a href="https://app.daily.dev/posts/vkiJLGz9l" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GRUB development moves to <a href="http://FreeDesktop.org" target="_blank" rel="noopener nofollow">FreeDesktop.org</a></strong>: The GRUB bootloader is migrating its upstream repository to <a href="http://FreeDesktop.org" target="_blank" rel="noopener nofollow">FreeDesktop.org</a> to adopt a modern GitLab-based merge request workflow. <a href="https://app.daily.dev/posts/EiDnSja30" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cilium hits 10 year milestone with dominant market share</strong>: Cilium now commands over 60% of the CNI market share as it celebrates its 10th anniversary with new mTLS and IPv6 features. <a href="https://app.daily.dev/posts/rtti5mtPR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pulumi adds stable OPA support with Gatekeeper compatibility</strong>: Pulumi now supports dropping existing Kubernetes Gatekeeper Rego files directly into its policy packs for shift-left enforcement. <a href="https://app.daily.dev/posts/CFvJEofzM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Erlang OTP 29 RC2 adds quantum resistant security</strong>: Erlang/OTP 29.0-rc2 introduces quantum-resistant SSH key exchange and JIT improvements for binary matching. <a href="https://app.daily.dev/posts/43R5cEvzp" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Cursor Composer 2 is just rebranded Kimi</strong>: Cursor recently ‘launched’ its Composer 2 model to much fanfare, only for users to discover it was just Moonshot AI’s Kimi k2.5 in a trench coat. While Cursor claims they added their own ‘post-training compute,’ failing to disclose the Chinese base model until caught is a classic move in the ‘rebrand and pray’ playbook of modern AI startups. Transparency is apparently a feature that didn’t make it into the MVP. <a href="https://app.daily.dev/feed-by-ids?id=2O2HmWwMM&amp;id=6IlX0UUsy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI tokens are the new company scrip</strong>: NVIDIA is now pitching ‘AI tokens’ as a legitimate pillar of engineer compensation, with Jensen Huang suggesting they could worth half a base salary. It is a brilliant strategy: pay your employees in company scrip that doesn’t vest, can’t pay a mortgage, and expires if you don’t use it to generate more ‘AI slop’ for the company. It’s not a bonus; it’s an electricity bill disguised as a benefit. <a href="https://app.daily.dev/posts/Ryzsn8a9R" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding is a gift for phishers</strong>: The ‘vibe coding’ trend has reached its logical conclusion with security researchers identifying ‘VibeScamming,’ where AI tools generate perfectly polished phishing emails that bypass traditional junk filters. We were promised AI would solve the talent gap; instead, it’s just democratizing the ability for low-effort scammers to look like Fortune 500 CEOs. If your security strategy relies on users spotting ‘bad grammar,’ you’re already compromised. <a href="https://app.daily.dev/posts/Puz1DfaR0" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
