<h2>Must know</h2>
<ul>
<li><strong>Escalating supply chain attacks hit Telnyx and LiteLLM</strong>: A partnership between threat actors TeamPCP and Vect has escalated into large-scale ransomware operations, exfiltrating 300GB of credentials from CI/CD pipelines. Malicious code was injected into the official Telnyx Python SDK and LiteLLM on PyPI, using advanced audio steganography and fileless execution to steal API keys. Security researchers at TruffleHog also found nearly 1,800 valid credentials for AWS, GitHub, and OpenAI exposed on public webpages, mostly within JavaScript files. <a href="https://app.daily.dev/feed-by-ids?id=56kU6AMbh&amp;id=PfVtSaby4&amp;id=RgBM7VgFk&amp;id=auXgHVyo4&amp;id=etL2H8W4G&amp;id=fyhf7Sv5C&amp;id=fz5dBqSfO&amp;id=g4gAOWava&amp;id=hDvxImKas&amp;id=i3m40RPI3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Inertia.js v3.0 drops Axios for a custom XHR client</strong>: The major release of Inertia.js v3.0 replaces Axios with a built-in client to shave 15KB off bundles and introduces a new useHttp hook for non-navigation requests. It adds first-class support for optimistic updates with automatic rollbacks and allows SSR to work in Vite dev mode without a separate Node process. Note that this is an ESM-only release and includes breaking changes for Svelte 4 users as it moves to Svelte 5, according to Laravel News. <a href="https://app.daily.dev/posts/WWmxp0DEw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenTelemetry Profiles signal enters public alpha</strong>: The OpenTelemetry Profiling SIG has released the alpha version of its Profiles signal, establishing a vendor-neutral standard for continuous production profiling. It includes an eBPF-based agent donated by Elastic that supports Go, Node.js, and Ruby, with a data format 40% smaller than standard pprof. While not yet ready for critical production, it allows for direct correlation between profiles and existing traces using trace_id, as reported by the OTel project. <a href="https://app.daily.dev/posts/DmZyP7rxh" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Laravel 13.2 adds symmetrical attributes and enum support for queues</strong>: New #[DateFormat] and #[WithoutTimestamps] attributes simplify model definitions, while queue attributes now accept backed enums directly. <a href="https://app.daily.dev/posts/D4iYewMHw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Turbolite enables sub 250ms SQLite queries directly from S3</strong>: This Rust-based VFS uses page-level compression and prefetching to make S3-hosted SQLite databases viable for multi-tenant apps. <a href="https://app.daily.dev/posts/9ZseH6udT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ScriptLite brings sandboxed ECMAScript execution to PHP</strong>: A new PHP interpreter allows safe execution of user-provided JS scripts with a C extension that runs 178x faster than the PHP VM. <a href="https://app.daily.dev/posts/3Xdusx761" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android 17 Beta 3 introduces post quantum APK signing</strong>: The latest beta implements a v3.2 signing scheme using ML-DSA and adds enforced read-only dynamic code loading to prevent injection. <a href="https://app.daily.dev/posts/sSVwrRoLW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PhpCodeArcheology integrates PHP static analysis with Claude</strong>: This new tool supports the Model Context Protocol, allowing AI agents to query 60+ code maintainability metrics directly. <a href="https://app.daily.dev/posts/CKfiYgxgR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft launches WinApp CLI to unify Windows dev workflows</strong>: The tool automates environment setup and debug identity management for .NET, Electron, and Rust applications on Windows. <a href="https://app.daily.dev/posts/Y5SIfePPI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Doom over DNS streams the entire game via TXT records</strong>: A wild project encodes the shareware WAD into 1,964 DNS records, streaming the game into memory via PowerShell without touching disk. <a href="https://app.daily.dev/posts/d2obb9tWI" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The GPT 5 dependency hallucination hazard</strong>: Sonatype researchers found that nearly 28% of GPT-5’s software upgrade recommendations are pure hallucinations, often inventing non-existent versions. Even worse, ‘cautious’ models frequently ignore critical vulnerabilities, while others actively suggest injecting known-malicious dependencies into your stack. Scale doesn’t fix stupid; ungrounded models are essentially high-speed technical debt generators. <a href="https://app.daily.dev/posts/DtWPHeTcL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>RLHF is lobotomizing AI uncertainty</strong>: New research shows that alignment techniques like DPO are breaking the ability of models to express when they don’t know something. Aligned models now produce the exact same wrong answer 10 times in a row, making sampling-based uncertainty checks completely useless. We’ve traded model honesty for a ‘helpful’ persona that is confidently wrong 79% of the time on factual queries. <a href="https://app.daily.dev/posts/EXphjL34Y" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Generative UI is the new accessibility nightmare</strong>: Despite the hype from OpenAI and Figma, ‘GenUI’ is currently a factory for inaccessible, card-heavy layouts that ignore basic web standards. Jakob Nielsen’s claim that AI will replace accessibility pros is being laughed at by developers who have to fix the broken, unsemantic HTML these models vomit out. If your ‘AI-first’ storefront takes 2 seconds to render a button, you haven’t innovated; you’ve just built a slow, broken website. <a href="https://app.daily.dev/feed-by-ids?id=2XfiIQqJ9&amp;id=p7H3t7Smf" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
