<h2>Must know</h2>
<ul>
<li><strong>Malicious LiteLLM versions on PyPI steal cloud credentials</strong>: PyPI has issued an urgent warning regarding LiteLLM versions 1.82.7 and 1.82.8, which were compromised by the TeamPCP group to exfiltrate AWS, GCP, and Azure secrets. According to Wiz, this package is present in 36% of cloud environments, making the potential blast radius for this supply chain attack significant. If you installed these versions during their two-hour window on March 25, rotate all environment variables and SSH keys immediately. <a href="https://app.daily.dev/posts/kjJd6k0JC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubernetes launches Agent Sandbox for stateful AI workloads</strong>: The Kubernetes SIG Apps group introduced the Agent Sandbox CRD to solve the ‘cold start’ and statefulness issues that plague traditional primitives like StatefulSets when running AI agents. This new declarative API includes a SandboxWarmPool to ensure instant startup and provides dedicated networking for inter-agent communication. It supports secure runtimes like gVisor and Kata Containers, signaling a shift toward making K8s a first-class host for agentic workflows. <a href="https://app.daily.dev/posts/wroMbko1c" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GrapheneOS rejects age verification and may exit major markets</strong>: The privacy-focused Android fork GrapheneOS announced it will not comply with new laws in the UK, Australia, and several US states that mandate age data collection at the OS level. Because the OS is designed to function without accounts or personal IDs, the team stated they would rather exit these regions than compromise their core architecture. This stance complicates their recent partnership with Motorola, which likely won’t ship GrapheneOS-powered hardware in those jurisdictions. <a href="https://app.daily.dev/posts/agWvIPypH" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Vercel debuts elastic build machines to optimize CI costs</strong>: A new beta feature automatically assigns Standard, Enhanced, or Turbo resources based on project complexity to prevent over-provisioning. <a href="https://app.daily.dev/posts/2w3G0XlDk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Safari 26.4 adds masonry grid lanes and WebTransport</strong>: The latest WebKit update ships 44 features including native masonry layouts via display: grid-lanes and low-latency bidirectional QUIC support. <a href="https://app.daily.dev/posts/vXvtsrMcB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Arm unveils 136-core AGI CPU for AI data centers</strong>: Built on 3nm lithography with Neoverse V3 cores, this new silicon supports 6TB of DDR5-8800 memory for massive agentic workloads. <a href="https://app.daily.dev/posts/S5lBW0zAU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS Load Balancer Controller hits GA for Gateway API</strong>: Version 3.1.0 replaces clunky annotations with type-safe CRDs for managing NLB and ALB routing directly through Kubernetes. <a href="https://app.daily.dev/posts/ELZeYfvNA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TutorialKit.rb brings interactive Rails tutorials to the browser</strong>: Using WebAssembly and WebContainers, this tool enables full Rails environments to boot in seconds without a backend. <a href="https://app.daily.dev/posts/5gQhfNWeF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js 24.14.1 Krypton fixes high-severity prototype pollution</strong>: The security release addresses CVE-2026-21710 in HTTP headers and several TLS-related crash vulnerabilities. <a href="https://app.daily.dev/posts/EJVcsmjRO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Astro 6.0 launches with built-in Fonts API and stable collections</strong>: The update includes a redesigned dev server with production parity and native Content Security Policy support. <a href="https://app.daily.dev/posts/0VvYcLDnm" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The Jevons Paradox hopium for developer jobs</strong>: A new article claims we should ‘stop worrying’ about AI displacement because, like steam engines and coal, cheaper software will just create infinite demand for more software. This ignores the fact that steam engines didn’t eventually learn how to build other steam engines without human intervention. It’s a comforting historical analogy used to mask the very real structural shift in entry-level engineering roles. <a href="https://app.daily.dev/posts/1powuaBgn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Apple’s bug reporting is a masterclass in gaslighting</strong>: A developer revealed that Apple ignored a critical network leak bug for three years, only to suddenly demand a ‘verification’ within two weeks or face closure. Even after Little Snitch developers confirmed the bug still exists in the latest macOS beta, Apple is sticking to its bureaucratic script. It’s a transparent attempt to artificially deflate open bug counts by exhausting the people actually trying to help them. <a href="https://app.daily.dev/posts/2hIqqorcX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Poisoned documentation is the new supply chain nightmare</strong>: Researchers found that Context Hub and other MCP-based documentation services are wide open to indirect prompt injection via GitHub pull requests. By embedding malicious instructions in a project’s docs, attackers can trick Anthropic’s Haiku model 100% of the time into installing fake PyPI packages. We’ve reached a point where your AI ‘assistant’ is so eager to help that it will happily invite a Trojan horse into your codebase because a README told it to. <a href="https://app.daily.dev/feed-by-ids?id=77SEcopfc&amp;id=7rYsSkUjq" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
