<h2>Must know</h2>
<ul>
<li><strong>Malicious LiteLLM versions on PyPI harvest cloud credentials</strong>: PyPI issued an urgent warning regarding two malicious versions of LiteLLM (1.82.7 and 1.82.8) that were live for two hours. These packages, part of a campaign by TeamPCP, exfiltrate environment variables, SSH keys, and cloud credentials for AWS, GCP, and Azure using a three-stage payload. Given that Wiz reports LiteLLM is present in 36% of cloud environments, immediate rotation of all secrets is advised if you pulled these versions. <a href="https://app.daily.dev/posts/kjJd6k0JC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubernetes SIG Apps introduces Agent Sandbox for AI workloads</strong>: The Kubernetes SIG Apps group launched the Agent Sandbox project, introducing a new Custom Resource Definition specifically for stateful AI agent workloads. Unlike traditional StatefulSets, this project focuses on instant startup and persistent identity, utilizing a SandboxWarmPool to eliminate cold starts. It supports secure runtimes like gVisor and Kata Containers, providing a declarative API for inter-agent communication via dedicated hostnames. <a href="https://app.daily.dev/posts/wroMbko1c" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Arm debuts AGI CPU for agentic data center infrastructure</strong>: Arm announced its first production silicon, the ARM AGI CPU, built on Neoverse V3 cores with Armv9.2 architecture for modern data centers. The chip features up to 136 cores on 3nm lithography and supports 96 lanes of PCIe Gen6 with CXL 3.0. Reference designs include a liquid-cooled Supermicro configuration capable of packing over 45,000 cores into a single rack to handle massive AI inference demands. <a href="https://app.daily.dev/posts/S5lBW0zAU" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AWS Load Balancer Controller adds Gateway API support</strong>: Version 3.1.0 replaces annotation-heavy configs with type-safe CRDs for NLB and ALB routing. <a href="https://app.daily.dev/posts/ELZeYfvNA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Hypura enables running oversized LLMs on Mac via NVMe tiering</strong>: This Rust-based scheduler uses storage-tier-aware tensor placement to run 70B models on 32GB machines without OOM. <a href="https://app.daily.dev/posts/9m4QpgqvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js 24.14.1 Krypton patches prototype pollution</strong>: The security release addresses eight CVEs, including high-severity fixes for HTTP headers and TLS crashes. <a href="https://app.daily.dev/posts/EJVcsmjRO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PostgreSQL 18.3 fixes critical encoding and WAL replay bugs</strong>: The update resolves a false-positive CVE flag in substring() and restores immutability for JSON strip functions. <a href="https://app.daily.dev/posts/aMhxjfcdv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel launches Elastic Build Machines in beta</strong>: The system automatically scales build resources between Standard, Enhanced, and Turbo tiers based on project complexity. <a href="https://app.daily.dev/posts/2w3G0XlDk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GrapheneOS rejects age verification mandates</strong>: The privacy-focused Android fork stated it will exit regions that require OS-level data collection at setup. <a href="https://app.daily.dev/posts/agWvIPypH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KubeVirt v1.8 adds Intel TDX for confidential VMs</strong>: The release introduces a Hypervisor Abstraction Layer and PCIe NUMA awareness for high-performance AI workloads. <a href="https://app.daily.dev/posts/2u9pTr13X" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The Jevons Paradox won’t save your job</strong>: Optimists are citing the Jevons Paradox to claim that AI efficiency will simply create ‘infinite demand’ for software, keeping every developer employed. This ignores the reality that most ‘new demand’ will be met by the same AI agents, not by hiring more humans to supervise the slop. It’s a comforting historical analogy used to mask the structural shift toward a much smaller, hyper-specialized workforce. <a href="https://app.daily.dev/posts/1powuaBgn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Apple’s Feedback Assistant is a bug-closing machine</strong>: A developer recently called out Apple for ignoring a network filter bug for three years, only to demand a ‘verification’ within two weeks or face closure. This isn’t a quality control process; it’s a transparent attempt to artificially deflate open bug counts by exhausting the reporters. If the bug is reproducible on the latest beta, the burden shouldn’t be on the person who did Apple’s QA for free three years ago. <a href="https://app.daily.dev/posts/2hIqqorcX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI documentation is the new supply chain nightmare</strong>: Researchers found that Context Hub and similar services are wide open to indirect prompt injection via poisoned documentation. By simply submitting a malicious PR to a public repo, attackers can trick coding agents into installing fake PyPI packages. We’ve spent years securing CI/CD pipelines only to let a ‘helpful’ LLM invite a Trojan horse because it read a README that told it to. <a href="https://app.daily.dev/feed-by-ids?id=77SEcopfc&amp;id=7rYsSkUjq" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
