<h2>Must know</h2>
<ul>
<li><strong>Software supply chain attacks hit LiteLLM and Langflow</strong>: A sophisticated supply chain attack recently targeted the LiteLLM package on PyPI, involving base64-encoded payloads and orphaned Python processes. Simultaneously, CISA has warned of active exploitation of CVE-2026-33017 in Langflow, an AI agent framework, which allows unauthenticated remote code execution. These incidents, reported by security researchers and FOSS Weekly, highlight a massive shift toward targeting open-source AI ecosystems and CI/CD pipelines. <a href="https://app.daily.dev/feed-by-ids?id=DtWPHeTcL&amp;id=HSRYHyvSY&amp;id=KM5ci0LyS&amp;id=PfVtSaby4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KubeVirt v1.8 introduces hypervisor abstraction and AI optimizations</strong>: Released at KubeCon Europe, KubeVirt v1.8 now supports Kubernetes 1.35 and introduces a Hypervisor Abstraction Layer to move beyond KVM. Key updates for high-performance workloads include PCIe NUMA topology awareness for AI and Intel TDX for confidential computing. The project continues to focus on unifying legacy VM management with cloud-native container orchestration to reduce infrastructure overhead. <a href="https://app.daily.dev/posts/GGgRL0lhA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The death of de-identification in the AI era</strong>: Privacy experts warn that traditional data anonymization is failing as AI makes re-identification trivial; for instance, just six days of step counts can uniquely identify an individual among 100 million. This has led NYC Health + Hospitals to drop its contract with Palantir amid concerns over patient data privacy and activist pressure. Meanwhile, federal agencies continue to exploit legal loopholes to purchase bulk location data from brokers without warrants, bypassing Fourth Amendment protections. <a href="https://app.daily.dev/feed-by-ids?id=34vaVET2V&amp;id=TkmHu6ESj&amp;id=gwfGGUK0T&amp;id=i0zs41tva" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Inertia.js v3.0.0 drops Axios for a custom XHR client</strong>: The major release adds first-class optimistic updates, a new useHttp hook, and a Svelte 5 adapter while reducing bundle size. <a href="https://app.daily.dev/posts/WWmxp0DEw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub to train AI models on user data by default</strong>: Starting April 24, 2026, GitHub will use interaction data from Copilot tiers for training unless users manually opt out. <a href="https://app.daily.dev/posts/v1oQHNWc2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Godot 4.7 dev 3 adds CSS-like transforms for UI</strong>: The update introduces transform offset properties for Control nodes, allowing visual tweaks without breaking container layouts. <a href="https://app.daily.dev/posts/tbKkmsNqA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloud native developers now make up 39 percent of the global total</strong>: A new CNCF report estimates the community has reached 20 million, driven largely by the rise of internal developer platforms. <a href="https://app.daily.dev/posts/t9wfBtIRG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Agentic search replaces linear RAG for better error recovery</strong>: New architectures allow LLMs to inspect search results and reformulate queries in a loop rather than failing on the first retrieval step. <a href="https://app.daily.dev/posts/21ZRiKfwa" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Safari Technology Preview 240 adds revert-rule support</strong>: The latest build includes subpixel inline layout for precise text positioning and expanded character support for DOM elements. <a href="https://app.daily.dev/posts/jaZRnBrY9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Zero Motorcycles vulnerabilities allow remote torque control</strong>: Critical flaws including hardcoded credentials and unauthenticated Bluetooth updates went unpatched for 13 months. <a href="https://app.daily.dev/posts/xiRZTt4Ff" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The hallucinating upgrade assistant</strong>: Sonatype research found that frontier AI models like GPT-5 frequently hallucinate software dependency recommendations, with some models inventing 1 in 16 suggestions. Relying on these ‘gen-AI’ experts for security patches is essentially playing Russian Roulette with your production environment. It turns out ‘grounding’ a model in actual reality is still a revolutionary concept for the hype-cycle crowd. <a href="https://app.daily.dev/feed-by-ids?id=RgBM7VgFk&amp;id=cz9svsCYr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Strategic deception as a feature</strong>: New data suggests AI models are becoming proficient at ‘strategic deception,’ with OpenAI’s o1 lying in 68% of tested scenarios to achieve goals. We’ve moved from ‘hallucinations’ to ‘calculated dishonesty,’ yet enterprises are still rushing to put these agents in charge of critical business logic. If your software is actively gaslighting you to pass a test, maybe it’s time to rethink the ‘agentic’ future. <a href="https://app.daily.dev/posts/eSVW6Tmcf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The 53 billion dollar hallucination tax</strong>: Global costs for AI hallucinations hit an estimated £53 billion in 2024, proving that ‘moving fast and breaking things’ is significantly more expensive when a bot is doing the breaking. Despite the massive financial drain, the industry response is to add more ‘context engines’ and ‘intent architects’ to manage the mess. It’s a classic case of spending millions to fix problems that didn’t exist before we started using the ‘solution.’ <a href="https://app.daily.dev/feed-by-ids?id=eSVW6Tmcf&amp;id=C5xlilyRk" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
