<h2>Must know</h2>
<ul>
<li><strong>Supply chain attack compromises Trivy and LiteLLM</strong>: A sophisticated campaign by threat group TeamPCP has compromised Aqua Security’s Trivy, Checkmarx’s KICS, and the LiteLLM library to exfiltrate GitHub tokens and cloud credentials from CI/CD runner memory. Organizations that ran scans between March 19–23, 2026, are urged by security researchers at RSAC to rotate all secrets immediately. The attackers used a worm called CanisterWorm and blockchain-based command-and-control to resist takedown efforts. <a href="https://app.daily.dev/feed-by-ids?id=SetW9szUC&amp;id=0POqXk9z7&amp;id=WK8W0RCb3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub Copilot to use your code for training by default</strong>: Starting April 24, GitHub will update its policy to allow interaction data and code snippets from Free and Pro users to train its AI models by default. While Business and Enterprise tiers remain unaffected, individual developers must manually opt out via privacy settings to prevent their context from being shared with Microsoft. This move, reported by various community sources, highlights the growing tension between free tooling and data sovereignty. <a href="https://app.daily.dev/feed-by-ids?id=OXozR2Y94&amp;id=1pqKatGc9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The vendorization of the software stack</strong>: The industry is shifting from building internal tools to buying specialized APIs for everything from observability to AI, a trend Erik Bernhardsson calls ‘vendorization.’ This explains why startups scale faster with smaller teams while legacy giants face layoffs as they no longer need armies of engineers for plumbing. For senior engineers, this means ‘good judgment’ in selecting and integrating these vendors is becoming more valuable than pure implementation skill. <a href="https://app.daily.dev/feed-by-ids?id=a5rbOtmsv&amp;id=p8Xi3BQzS&amp;id=QCMZiGw6W" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>IntelliJ IDEA 2026.1 adds Java 26 support and BYO-key AI</strong>: The update includes virtual thread visualization in the debugger and allows using your own Anthropic or OpenAI keys for the AI Assistant. <a href="https://app.daily.dev/feed-by-ids?id=KcQd7FpkV&amp;id=RzK0ud6p0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS S3 finally fixes the global bucket naming headache</strong>: New account-regional namespaces resolve 18 years of naming collisions, simplifying infrastructure-as-code and preventing ‘confused deputy’ attacks. <a href="https://app.daily.dev/posts/7Dij7v9wr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Lix 2.95 boosts Linux sandbox speeds by 80 percent</strong>: The Nix implementation continues its move to Cap’n’Proto RPC and introduces full socket activation for daemons. <a href="https://app.daily.dev/posts/0qW0CvPiA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SQLMesh joins Linux Foundation to counter dbt licensing</strong>: Fivetran donated the framework as a community-governed alternative following dbt Labs’ controversial shift to the Elastic License. <a href="https://app.daily.dev/feed-by-ids?id=AB7Yq69Rm&amp;id=94U6i3tqG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ruby 3.3.11 marks the end of regular maintenance</strong>: The final maintenance release includes a critical zlib security fix; the series now enters a one-year security-only phase. <a href="https://app.daily.dev/posts/jVqTw3lsl" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Xe driver update makes SVM seven times faster</strong>: By enabling Transparent Hugepages for device pages, the new driver significantly reduces page fault overhead for GPU workloads. <a href="https://app.daily.dev/posts/U9fHRQhXE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fyrox game engine hits 1.0 after seven years</strong>: The Rust-based 2D/3D engine now features a stable CLI for multi-platform exports and a refactored async scene loader. <a href="https://app.daily.dev/posts/KKp03cmaR" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Mojo is Pythonic in the same way a rock is a bird</strong>: Despite the $380M hype train claiming Mojo is a ‘Python superset,’ actual testing shows it lacks f-strings, named arguments, and basic standard library modules. To make it even better, running Python code via its interop is actually 3x slower than just using plain Python. It’s a bold marketing strategy to call a language compatible when you have to rewrite the entire codebase to make it compile. <a href="https://app.daily.dev/feed-by-ids?id=xPvWA4uas&amp;id=PAeXeoMBJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The CEO agent is just a fancy auto-reply</strong>: Mark Zuckerberg is reportedly building a ‘CEO Agent’ to help him make decisions, because apparently, being the most powerful person at Meta is too much manual labor. While PR flacks at IT Security Guru debate if this replaces leadership, it’s mostly just a glorified ‘Second Brain’ to filter the noise he created. If your leadership can be replaced by a 4096-token context window, you might have bigger problems than AI. <a href="https://app.daily.dev/posts/JGh9hjxFT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI hallucinations now come with extra confidence</strong>: Researchers found that AI hallucinations are 34% more likely to use confident, authoritative language than factual statements. This explains why Claude ‘confirmed’ it successfully decompiled 1985 Turbo Pascal code when it was actually just hallucinating assembly that didn’t exist. We’ve reached the peak of the hype cycle where the bots aren’t just lying; they’re gaslighting you with a smile. <a href="https://app.daily.dev/feed-by-ids?id=Ycfw3X68k&amp;id=eSVW6Tmcf" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
