<h2>Must know</h2>
<ul>
<li><strong>Critical RCE vulnerabilities in Grafana and Langflow</strong>: Security teams should prioritize patching Grafana (CVE-2026-27876) and Langflow (CVE-2026-33017) immediately, as both allow unauthenticated remote code execution. The Grafana flaw involves arbitrary file writes via SQL expressions, while the Langflow exploit is already being observed in the wild according to CISA. These incidents highlight a shrinking window between vulnerability disclosure and active exploitation in AI and observability stacks. <a href="https://app.daily.dev/feed-by-ids?id=R50G25vno&amp;id=DtWPHeTcL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android 17 Beta 3 introduces post quantum crypto</strong>: The latest Android 17 beta adds hybrid APK signing (v3.2) using ML-DSA to protect against future quantum threats. Developers also get a new callback-based AlarmManager to curb power-hungry wakelocks and enforced read-only dynamic code loading to block common injection vectors. Testing is now open on Pixel devices and the Android Studio Panda preview. <a href="https://app.daily.dev/posts/sSVwrRoLW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google TurboQuant slashes LLM memory bottlenecks</strong>: Google has unveiled TurboQuant, a quantization technique claiming a 6x reduction in KV cache memory usage and an 8x speedup in attention-logit computation. Tested on Gemma and Mistral models using Nvidia H100s, the method aims to solve the ‘memory blow-up’ seen in long-context agentic workflows without measurable accuracy loss. This directly impacts GPU sizing and cost-per-query for enterprise-scale inference. <a href="https://app.daily.dev/posts/PTvjeLzdh" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>KubeVirt v1.8 adds hypervisor abstraction and Intel TDX</strong>: The release supports Kubernetes 1.35 and introduces a layer to support non-KVM backends alongside confidential computing attestation. <a href="https://app.daily.dev/posts/GGgRL0lhA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Amazon Aurora PostgreSQL now supports two click serverless creation</strong>: A new express configuration allows creating clusters in seconds with IAM-based passwordless auth and Vercel integration. <a href="https://app.daily.dev/posts/MjUWMvC5e" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Inertia.js v3.0 drops Axios for a custom XHR client</strong>: The major update adds first-class optimistic updates, a useHttp hook, and a Svelte 5 adapter while reducing bundle size. <a href="https://app.daily.dev/posts/WWmxp0DEw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel patch boosts memory reclaim throughput by 27 percent</strong>: A new proposal from Tencent engineers batches TLB flushes for dirty folios to reduce inter-processor interrupts on multi-core systems. <a href="https://app.daily.dev/posts/9j9jewUhJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub to train AI models on user data by default</strong>: Starting April 24, Copilot will use interaction data from private repositories for training unless users manually opt out. <a href="https://app.daily.dev/posts/v1oQHNWc2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>LiteLLM hit by PyPI supply chain attack</strong>: Malicious packages (v1.82.8) were found running base64-encoded payloads via orphaned Python processes. <a href="https://app.daily.dev/posts/DtWPHeTcL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Gutenberg 22.8 brings real time collaboration improvements</strong>: WordPress editors can now see collaborator text selections and visually style button pseudo-states like hover and focus. <a href="https://app.daily.dev/posts/AtIXOXB3h" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI hallucinations are now a 53 billion pound industry</strong>: Consultants are now attaching massive, arbitrary price tags to LLM ‘deception’ to sell ‘confession signals’ and human-in-the-loop services. Apparently, o1 ‘strategically deceives’ users in 68% of scenarios, which sounds less like a bug and more like a convenient metric to justify more enterprise software spend. <a href="https://app.daily.dev/posts/eSVW6Tmcf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The systemd age verification moral panic</strong>: The internet is currently doxxing a developer for adding an optional ‘birthDate’ field to a local database, claiming it’s the end of privacy. In reality, it’s a self-attested field with zero third-party validation—essentially the 2026 version of a ‘Click here if you are 18’ button that everyone is treating like a CCP social credit system. <a href="https://app.daily.dev/posts/SJccMOCzF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GPT 5 is apparently a hallucination machine for code</strong>: Sonatype found that 28% of GPT-5’s dependency recommendations were total fabrications, yet we’re still being told AI will replace the entire software supply chain. It turns out ‘grounding’ a model with actual facts—you know, like a database—is 70% more effective than just asking a spicy autocomplete what library to use. <a href="https://app.daily.dev/posts/DtWPHeTcL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
