<h2>Must know</h2>
<ul>
<li><strong>Malicious LiteLLM versions on PyPI steal cloud credentials</strong>: PyPI issued an urgent warning regarding two malicious versions of LiteLLM (1.82.7 and 1.82.8) that were live for two hours as part of a sophisticated supply chain attack. The payload harvested environment variables, SSH keys, and cloud credentials for AWS, GCP, and Azure, exfiltrating them to attacker-controlled servers. Given LiteLLM’s presence in 36% of cloud environments according to Wiz, developers should immediately rotate all secrets if these versions were installed. <a href="https://app.daily.dev/posts/kjJd6k0JC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubernetes SIG Apps launches Agent Sandbox for AI workloads</strong>: The Kubernetes SIG Apps group introduced the Agent Sandbox project, a new Custom Resource Definition designed specifically for the stateful and instant-startup requirements of AI agents. Unlike traditional StatefulSets, this project includes a SandboxWarmPool to eliminate cold starts and provides dedicated networking for inter-agent communication. It supports secure runtimes like gVisor and Kata Containers, signaling a move toward making Kubernetes a first-class host for agentic workflows. <a href="https://app.daily.dev/posts/wroMbko1c" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Arm debuts AGI CPU for agentic data centers</strong>: Arm has announced its first production silicon, the ARM AGI CPU, specifically architected for AI infrastructure and agentic workloads. Built on 3nm lithography with up to 136 Neoverse V3 cores, the chip supports massive memory throughput with 6TB of DDR5-8800 and PCIe Gen6. Reference designs from Supermicro suggest these chips can scale to over 45,000 cores per liquid-cooled rack to meet the power demands of modern LLM clusters. <a href="https://app.daily.dev/posts/S5lBW0zAU" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>IntelliJ IDEA 2026.1 adds BYOK for Anthropic and OpenAI</strong>: The new release supports the ACP agent protocol and introduces AI-powered commit grouping and activity recaps. <a href="https://app.daily.dev/posts/KcQd7FpkV" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel launches elastic build machines in beta</strong>: The system automatically assigns Standard, Enhanced, or Turbo resources based on project complexity to optimize build costs. <a href="https://app.daily.dev/posts/2w3G0XlDk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS Load Balancer Controller hits GA for Gateway API</strong>: Version 3.1.0 replaces annotation-heavy configs with type-safe CRDs for both NLB and ALB routing. <a href="https://app.daily.dev/posts/ELZeYfvNA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TutorialKit.rb brings interactive Rails tutorials to the browser</strong>: Using WebAssembly and WebContainers, it enables full Ruby environments to run client-side with Claude Code integration. <a href="https://app.daily.dev/posts/5gQhfNWeF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js 24.14.1 LTS fixes high severity prototype pollution</strong>: The ‘Krypton’ security update addresses eight CVEs, including a critical fix for prototype pollution via HTTP headers. <a href="https://app.daily.dev/posts/EJVcsmjRO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GrapheneOS rejects age verification laws and threatens regional exits</strong>: The privacy-focused Android fork will not comply with mandates requiring data collection at the OS level. <a href="https://app.daily.dev/posts/agWvIPypH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>RubyGems and Bundler 4.0.9 improve install performance</strong>: The update introduces a priority queue for gem downloads and normalizes worker counts for parallel operations. <a href="https://app.daily.dev/posts/4kjnCR0KQ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The Jevons Paradox as a developer job security blanket</strong>: A recent article claims we should stop worrying about AI displacement because the Jevons Paradox says efficiency creates more demand, just like steam engines and coal. This ignores the fact that coal doesn’t have a brain, whereas AI agents are specifically designed to replicate the cognitive labor that makes a developer valuable. It’s a comforting historical analogy that conveniently skips over the part where the ‘pivot’ usually involves lower wages and higher commoditization. <a href="https://app.daily.dev/posts/1powuaBgn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Apple’s Feedback Assistant is a bug-closing machine</strong>: A developer revealed that Apple ignored a network leak bug for three years, only to demand a verification within two weeks or face closure. This isn’t a quality control process; it’s a transparent attempt to artificially deflate open bug counts by exhausting the reporters. If the goal was actually fixing software, they wouldn’t ignore external confirmation from Little Snitch developers just to play administrative games. <a href="https://app.daily.dev/posts/2hIqqorcX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The documentation to malware pipeline</strong>: Researcher Mickey Shmueli demonstrated that services like Context Hub, which feed API docs to AI agents, are basically open doors for supply chain attacks. By poisoning documentation via GitHub PRs, attackers can trick models like Anthropic’s Haiku into installing malicious packages 100% of the time. We’ve spent decades securing code, only to realize our new AI ‘colleagues’ will blindly execute whatever garbage they find in a README file. <a href="https://app.daily.dev/posts/77SEcopfc" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
