<h2>Must know</h2>
<ul>
<li><strong>Massive supply chain escalation hits Telnyx and LiteLLM</strong>: A partnership between threat actors TeamPCP and Vect has escalated into a large-scale ransomware operation, exfiltrating 300 GB of credentials from CI/CD pipelines. The official Telnyx Python SDK and LiteLLM packages on PyPI were injected with malware using audio steganography and fileless execution to steal API keys. Security researchers at TruffleHog also found nearly 1,800 valid credentials for AWS and OpenAI exposed in public JavaScript files, with some remaining public for over a year. <a href="https://app.daily.dev/feed-by-ids?id=56kU6AMbh&amp;id=PfVtSaby4&amp;id=RgBM7VgFk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenTelemetry Profiles signal enters public alpha</strong>: The OpenTelemetry Profiling SIG has released the alpha version of its Profiles signal, establishing a vendor-neutral standard for continuous production profiling. It introduces a unified OTLP Profiles data format that is 40% smaller than pprof and includes an eBPF-based agent donated by Elastic. While not yet ready for critical production, it allows for cross-signal correlation with traces via trace and span IDs, according to official project documentation. <a href="https://app.daily.dev/posts/DmZyP7rxh" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DarkSword exploit kit compromises 300 million iPhones</strong>: A sophisticated exploit kit named DarkSword has been active since late 2025, chaining six vulnerabilities including a WebGPU-based sandbox escape and kernel privilege escalation. The kit operates via drive-by browser attacks requiring zero user interaction and affects iOS versions up to 18.7. Cybersecurity experts at Threat Wire report that the server-side code shows signs of AI generation, suggesting a commoditization of nation-state-grade mobile exploits. <a href="https://app.daily.dev/feed-by-ids?id=BlsA6PNKf&amp;id=6ImewWjn0" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Claude Code launches autonomous PR management</strong>: Anthropic’s new tool monitors GitHub PRs to autonomously resolve CI failures and address review comments without developer intervention. <a href="https://app.daily.dev/posts/omakY5RaF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Turbolite enables sub 50ms SQLite queries from S3</strong>: This experimental Rust-based VFS uses B-tree-aware page grouping and zstd multi-frame compression to serve SQLite directly from object storage. <a href="https://app.daily.dev/posts/9ZseH6udT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android 17 Beta 3 adds post quantum APK signing</strong>: The latest beta implements a hybrid v3.2 signing scheme using ML-DSA and introduces a persistent location access indicator similar to the camera/mic dots. <a href="https://app.daily.dev/feed-by-ids?id=sSVwrRoLW&amp;id=F0eiIylT9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust 1.94.1 patches critical tar crate vulnerabilities</strong>: The point release addresses CVE-2026-33055 and CVE-2026-33056 while fixing regressions in thread spawning for WASI targets. <a href="https://app.daily.dev/posts/r8kL7pL4j" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI Responses API adds hosted containerized workspaces</strong>: The API now supports autonomous agents with a built-in execution loop, shell tools, and context compaction for long-running tasks. <a href="https://app.daily.dev/posts/mD5xT9XWY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ScriptLite brings sandboxed ECMAScript to PHP</strong>: A new interpreter allows safe execution of user-provided scripts in PHP with a native C extension that is 178x faster than the standard VM. <a href="https://app.daily.dev/posts/3Xdusx761" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AMD submits Linux 7.1 driver with SMU 15 support</strong>: The pull request includes graphics queue priority fixes and DCN 4.2 updates, alongside a ROCm 7.12 tech preview for Ryzen AI 400 series. <a href="https://app.daily.dev/feed-by-ids?id=5SsZRRWXp&amp;id=VV1vqMj2N" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>RLHF is lobotomizing your model’s uncertainty</strong>: New research shows that DPO alignment is breaking sampling-based uncertainty estimation, forcing models to give the same confident answer even when they are wrong. Qwen3-14B’s ‘single-cluster’ rate for factual errors jumped from 1% to 28% after alignment, making SelfCheckGPT and other reliability metrics effectively useless. We’ve traded model honesty for a consistent, polite hallucination that scores well on benchmarks but fails in production. <a href="https://app.daily.dev/feed-by-ids?id=EXphjL34Y&amp;id=59Px0AiZs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI claims GPT 4.5 writes production frontends</strong>: OpenAI’s latest blog post insists their models produce ‘production-ready’ UIs, but actual benchmarks show they consistently output repetitive, card-heavy layouts regardless of the prompt. Developers are noting that Claude and Gemini are actually producing usable code while OpenAI seems to be training on a diet of 2015-era Bootstrap templates. It’s a bold marketing claim for a model that still struggles with basic CSS grid alignment. <a href="https://app.daily.dev/feed-by-ids?id=p7H3t7Smf&amp;id=2XfiIQqJ9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linear declares issue tracking dead to sell more AI</strong>: Linear is claiming that traditional issue tracking is ‘dead’ because it was built for an ‘outdated handoff model,’ which is a convenient narrative when you’re pivoting to a ‘context-to-execution platform.’ While they tout a 5x growth in agent-completed work, most senior engineers know that ‘code as plan’ is just a fancy way of saying we’re going to let AI generate technical debt faster than we can track it. It’s not a revolution; it’s a rebrand of the same Jira-fatigue we’ve had for a decade. <a href="https://app.daily.dev/feed-by-ids?id=rFXUcNGBW&amp;id=bb6i7HLyS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
