<h2>Must know</h2>
<ul>
<li><strong>Supply chain attacks escalate with credential stealing malware</strong>: A massive surge in supply chain compromises has hit the Telnyx Python SDK and LiteLLM packages on PyPI, injecting malware that uses audio steganography to exfiltrate credentials. Security researchers at TruffleHog also discovered over 1,700 valid API keys for AWS, GitHub, and OpenAI exposed on public webpages, with 84% hidden in JavaScript files. CISA has issued an urgent warning for CVE-2026-33017, a critical code injection flaw in the Langflow AI platform currently being exploited to steal Anthropic and AWS keys. <a href="https://app.daily.dev/feed-by-ids?id=56kU6AMbh&amp;id=PfVtSaby4&amp;id=RgBM7VgFk&amp;id=auXgHVyo4&amp;id=etL2H8W4G&amp;id=fyhf7Sv5C&amp;id=fz5dBqSfO&amp;id=g4gAOWava&amp;id=hDvxImKas&amp;id=i3m40RPI3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenTelemetry Profiles signal enters public alpha</strong>: The OpenTelemetry Profiling SIG has released the public alpha of the Profiles signal, establishing a vendor-neutral standard for continuous production profiling. This release includes an eBPF-based agent donated by Elastic that supports Go, Ruby, and .NET, alongside a unified OTLP data format that is 40% smaller than standard pprof. While not yet recommended for critical production, it allows for direct correlation between profiles and existing traces via span IDs. <a href="https://app.daily.dev/posts/DmZyP7rxh" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DarkSword exploit kit compromises millions of iOS devices</strong>: A sophisticated exploit kit named DarkSword has been identified by Threat Wire, targeting iOS versions 18.4 through 18.7 with near-zero interaction required. The kit chains six vulnerabilities, including a WebGPU-based sandbox escape and kernel privilege escalation, affecting an estimated 300 million devices. Apple has released patches, but security architects warn that the kit’s server-side code shows signs of AI generation, suggesting a rapid commoditization of nation-state-grade exploits. <a href="https://app.daily.dev/feed-by-ids?id=6ImewWjn0&amp;id=BlsA6PNKf" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Claude Code launches autonomous PR management</strong>: Anthropic’s new cloud tool monitors GitHub PRs to autonomously fix CI failures and address review comments without developer intervention. <a href="https://app.daily.dev/posts/omakY5RaF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust 1.94.1 fixes critical regressions and security flaws</strong>: The point release resolves a thread spawning bug in WASI and updates the tar crate to patch two CVEs. <a href="https://app.daily.dev/posts/r8kL7pL4j" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Turbolite enables sub 50ms SQLite queries from S3</strong>: This experimental Rust-based VFS uses B-tree-aware page grouping and zstd compression to serve SQLite databases directly from object storage. <a href="https://app.daily.dev/posts/9ZseH6udT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android 17 Beta 3 implements post quantum signing</strong>: The latest beta introduces a v3.2 APK signing scheme using ML-DSA and enforces read-only dynamic code loading to prevent injection. <a href="https://app.daily.dev/posts/sSVwrRoLW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ocirender uses Rust to speed up container pulls by 31 percent</strong>: By processing OCI layers in reverse order using an in-memory overlay merge, this library eliminates intermediate disk extraction for faster execution. <a href="https://app.daily.dev/posts/9nORTX9om" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AMD submits AMDGPU updates for Linux 7.1</strong>: The pull request adds support for SMU 15.0.8 hardware and fixes graphics queue priority issues ahead of the mid-April merge window. <a href="https://app.daily.dev/posts/5SsZRRWXp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PhpCodeArcheology brings MCP support to PHP static analysis</strong>: The new tool computes 60+ metrics and allows AI assistants like Claude to query architectural health directly via the Model Context Protocol. <a href="https://app.daily.dev/posts/CKfiYgxgR" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The DPO alignment tax is making LLMs lobotomized</strong>: New research shows that RLHF techniques like DPO are breaking the ability of models to express uncertainty, forcing them to give the same confident answer even when they’re guessing. In up to 79% of cases, aligned models produce identical semantic clusters, making standard uncertainty estimation methods as useful as a coin flip. We’ve traded model honesty for a ‘helpful’ facade that hides internal computational chaos. <a href="https://app.daily.dev/posts/EXphjL34Y" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI claims GPT 4.5 produces production ready frontends</strong>: OpenAI’s latest blog post is being called out by developers for claiming their models produce ‘production-ready’ UIs, while benchmarks show they mostly just spit out repetitive, card-heavy layouts. Compared to Claude or Gemini, GPT models seem stuck with outdated training data that fails to grasp modern CSS or usable component architecture. It turns out ‘AI-generated’ is still just a fancy word for ‘generic bootstrap template from 2018.’ <a href="https://app.daily.dev/posts/p7H3t7Smf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linear declares issue tracking dead to sell more AI</strong>: Linear is claiming that traditional issue tracking is ‘dead’ because it was built for an ‘outdated handoff model,’ which is a convenient narrative for a company pivoting to an AI-centric platform. While they tout a 5x growth in agent-completed work, they’re mostly just rebranding automated ticket updates as ‘context-to-execution.’ It’s a classic case of a SaaS vendor trying to disrupt a problem they helped create by adding a chatbot on top. <a href="https://app.daily.dev/feed-by-ids?id=bb6i7HLyS&amp;id=rFXUcNGBW" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
