<h2>Must know</h2>
<ul>
<li><strong>Supply chain attacks hit Telnyx and LiteLLM via PyPI</strong>: A sophisticated campaign by threat actor TeamPCP has compromised the official Telnyx Python SDK and LiteLLM packages on PyPI, injecting malware that uses audio steganography for data exfiltration. According to security researchers, the Telnyx malware (versions 4.87.1 and 4.87.2) executes fileless in-memory payloads and targets CI/CD credentials. Users are urged to downgrade to 4.87.0 and rotate all secrets immediately as exfiltrated data is already appearing on BreachForums. <a href="https://app.daily.dev/feed-by-ids?id=56kU6AMbh&amp;id=PfVtSaby4&amp;id=RgBM7VgFk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Turbolite brings Rust powered SQLite queries to S3</strong>: A new experimental VFS called turbolite allows SQLite to query data directly from S3-compatible storage with sub-250ms cold latency. Written in Rust, it utilizes B-tree-aware page grouping and zstd multi-frame compression to minimize S3 GET requests. This is a significant development for multi-tenant architectures where managing thousands of individual block storage volumes is cost-prohibitive. <a href="https://app.daily.dev/posts/9ZseH6udT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenTelemetry Profiles signal enters public alpha</strong>: The OpenTelemetry Profiling SIG has released the alpha version of the Profiles signal, establishing a vendor-neutral standard for continuous production profiling. It introduces a unified OTLP Profiles data format that is 40% smaller than pprof and includes an eBPF-based agent donated by Elastic. While not yet production-ready, it enables cross-signal correlation with traces via trace_id, filling a major gap in the OTel ecosystem. <a href="https://app.daily.dev/posts/DmZyP7rxh" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Ubuntu adopts ntpd-rs for system time synchronization</strong>: Canonical is replacing Chrony and LinuxPTP with the Rust-based ntpd-rs implementation starting in Ubuntu 26.10 for improved memory safety. <a href="https://app.daily.dev/posts/MuH00Ge5n" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android 17 Beta 3 implements post quantum signing</strong>: The latest beta introduces APK signing v3.2 using ML-DSA for post-quantum cryptography and enforced read-only dynamic code loading. <a href="https://app.daily.dev/posts/sSVwrRoLW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust 1.94.1 patches security flaws in tar crate</strong>: This point release addresses CVE-2026-33055 and fixes regressions in thread spawning for wasm32-wasip1-threads. <a href="https://app.daily.dev/posts/r8kL7pL4j" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Jsongrep uses DFAs for high speed JSON querying</strong>: A new Rust CLI tool compiles queries into deterministic finite automata to walk JSON trees in a single pass, outperforming jq on large datasets. <a href="https://app.daily.dev/posts/PwnEwPTeM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ocirender accelerates OCI images via Rust and SquashFS</strong>: Edera’s new library pulls images 31% faster than Docker by processing layers in reverse and using an in-memory overlay engine. <a href="https://app.daily.dev/posts/9nORTX9om" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft releases WinApp CLI for unified Windows dev</strong>: The tool unifies environment setup and signing workflows across .NET, C++, and Rust, including experimental Windows API projections. <a href="https://app.daily.dev/posts/Y5SIfePPI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js HTTP parser migration to llhttp deep dive</strong>: Core maintainers discussed the performance costs of the C++/JS boundary and the potential for compiling llhttp to WebAssembly via undici. <a href="https://app.daily.dev/posts/ea169A6aB" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Algorithm interviews are a lie and your CTO knows it</strong>: An anonymous CTO admits that LeetCode-style puzzles have zero correlation with engineering performance, especially now that they are ‘trivially bypassable’ by LLMs. Despite research showing a 50% performance drop when developers are watched, companies continue this hazing ritual because they lack the imagination to test for actual debugging or documentation skills. It’s a 5% skill test for a 100% job. <a href="https://app.daily.dev/posts/jmJ4lUOji" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Technical debt is just a skill issue in a trench coat</strong>: A new hot take claims 95% of technical debt isn’t a strategic trade-off but simply ‘developer inexperience’ or being overwhelmed. It conveniently ignores that most ‘mess’ is actually the result of shifting business requirements and impossible deadlines imposed by the people writing these articles. Calling architectural rot a ‘skill issue’ is the ultimate senior engineer gaslight. <a href="https://app.daily.dev/posts/2OtRYg3MV" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The myth of the unhackable iPhone dies again</strong>: The DarkSword exploit kit has been quietly compromising iPhones since late 2025 using a chain of six vulnerabilities that require zero user interaction. While marketing departments push the ‘Lockdown Mode’ as a silver bullet, the reality is a drive-by browser attack that bypasses PAC and escapes the sandbox via the GPU. Your ‘secure’ device is just one unpatched WebGPU bug away from being a paperweight. <a href="https://app.daily.dev/feed-by-ids?id=BlsA6PNKf&amp;id=6ImewWjn0" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
