<h2>Must know</h2>
<ul>
<li><strong>Supply chain attacks escalate with AI and CI/CD exploits</strong>: A massive surge in software supply chain attacks is targeting open-source ecosystems, with the LiteLLM PyPI package recently falling victim to a backdoor involving base64-encoded payloads. Security researchers at Sonatype found that AI-generated dependency recommendations from models like GPT-5 hallucinate nearly 28% of the time, often inventing non-existent packages that attackers can then register. Meanwhile, CISA has flagged a critical remote code execution vulnerability in the Langflow AI framework (CVE-2026-33017) that is already being exploited in the wild. <a href="https://app.daily.dev/feed-by-ids?id=DtWPHeTcL&amp;id=HSRYHyvSY&amp;id=KM5ci0LyS&amp;id=PfVtSaby4&amp;id=RgBM7VgFk&amp;id=XVsg2663I&amp;id=cz9svsCYr&amp;id=d7ncWB9vs&amp;id=etL2H8W4G&amp;id=fz5dBqSfO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KubeVirt v1.8 unifies VM and container management</strong>: Released at KubeCon Europe, KubeVirt v1.8 introduces a Hypervisor Abstraction Layer to support backends beyond KVM, aiming to reduce infrastructure costs by running legacy VMs on the same Kubernetes control plane as containers. The update adds support for Kubernetes 1.35, Intel TDX for confidential computing, and PCIe NUMA topology awareness specifically for AI workloads. Scalability testing confirms the control plane can now handle up to 8,000 virtual machine instances with minimal memory overhead. <a href="https://app.daily.dev/posts/GGgRL0lhA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>React invariants and the physics of async UI</strong>: SolidJS creator Ryan Carniato argues that React’s most criticized patterns, such as explicit dependency arrays and deferred state commits, are actually unavoidable ‘physics’ for any UI framework handling asynchronous state. In his work on Solid 2.0, Carniato found that maintaining synchronous consistency requires isolating async work from the commit phase to prevent interleaving updates. This suggests that even fine-grained reactive frameworks must eventually adopt React-like constraints to ensure predictable rendering in complex applications. <a href="https://app.daily.dev/posts/oXQQ8zxuy" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Inertia.js v3.0.0 drops Axios for a custom XHR client</strong>: The major release adds first-class optimistic updates, a useHttp hook, and Svelte 5 support while reducing bundle sizes. <a href="https://app.daily.dev/posts/WWmxp0DEw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub to train AI models on user data by default</strong>: Starting April 24, 2026, interaction data from Copilot users will be used for training unless manually opted out in settings. <a href="https://app.daily.dev/posts/v1oQHNWc2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Godot 4.7 dev 3 introduces CSS-like Control transforms</strong>: The update includes transform offset properties that don’t break container layouts, plus HDR support for Linux via Wayland. <a href="https://app.daily.dev/posts/tbKkmsNqA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Safari Tech Preview 240 adds subpixel inline layout</strong>: The release improves text positioning precision and adds the revert-rule CSS keyword for better style inheritance control. <a href="https://app.daily.dev/posts/jaZRnBrY9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloud native developers now number 20 million globally</strong>: A new CNCF report indicates 39% of all developers now work with cloud-native technologies, a 28% increase in six months. <a href="https://app.daily.dev/posts/t9wfBtIRG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PVS-Studio uncovers logic bugs in S&amp;Box game engine</strong>: Static analysis of the C# 14 codebase revealed common pitfalls like operator precedence confusion and deferred LINQ execution errors. <a href="https://app.daily.dev/posts/p3Q6vXWnV" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Security as Code becomes the 2026 compliance baseline</strong>: Automated policy enforcement via OPA and Sentinel is replacing manual audits as the standard for SOC 2 and DORA compliance. <a href="https://app.daily.dev/posts/kjzObhPK3" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The myth of the software death model</strong>: Modern software is great at creating state but allergic to cleaning it up, as evidenced by iOS simulators eating 200GB of ‘hidden’ storage and Docker ‘prune’ commands that conveniently ignore named volumes. We’ve built an industry on performative deletion UIs that leave orphaned services and system-managed assets to rot in the background. It’s not ‘maintenance mode’; it’s just digital hoarding rebranded as a platform feature. <a href="https://app.daily.dev/posts/9dzlQd5j9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Context engineering is just RAG with a better publicist</strong>: The industry is pivoting from ‘RAG is broken’ to ‘you just need a Live Operational Data Layer,’ which is a fancy way of saying you should probably use a database that actually works. Proponents claim we need ‘intent architects’ to manage ‘context engines,’ yet the solution usually involves just stuffing more tokens into a window and hoping the model doesn’t hallucinate. If your AI agent needs a digital twin to decide which SQL query to run, you don’t have an architecture; you have a Rube Goldberg machine. <a href="https://app.daily.dev/feed-by-ids?id=Wn2FSGQOP&amp;id=gIi894ZiM&amp;id=C5xlilyRk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The AI job search arms race is here</strong>: Developers are now building custom AI scrapers to auto-generate ‘tailored’ resumes and cover letters, effectively fighting the HR department’s automated filtering bots with their own local LLMs. We’ve reached a peak-absurdity loop where AI writes the application, AI screens the application, and no human actually reads anything until the interview. It’s a race to the bottom where the most ‘self-aware’ candidate is simply the one with the best-tuned prompt for Claude Sonnet. <a href="https://app.daily.dev/posts/0YroeqW2V" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
