<h2>Must know</h2>
<ul>
<li><strong>Istio pivots to agentic AI at KubeCon</strong>: Istio announced major updates at KubeCon 2026 to position itself as the primary service mesh for AI-driven workloads. Key features include the Gateway API Inference Extension for standardized AI traffic management and experimental agentgateway support for securing communication between AI agents and models. According to Istio, these updates address the 66% of organizations already running generative AI on Kubernetes. <a href="https://app.daily.dev/posts/qhBrMdykE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Massive supply chain attack hits Trivy and npm</strong>: A threat group named TeamPCP executed a multi-stage attack via Aqua Security’s Trivy scanner, exploiting GitHub Actions to steal credentials and spread the CanisterWorm malware across npm packages. The breach reportedly compromised 300 GB of credentials from projects with over 100 million monthly downloads. Security researchers at Socket and Aqua Security are tracking the escalation as it hits other ecosystems like the Telnyx Python SDK. <a href="https://app.daily.dev/feed-by-ids?id=EeEZo06er&amp;id=fyhf7Sv5C&amp;id=1N56isWio" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TypeScript 6.0 marks the end of the JavaScript compiler</strong>: TypeScript 6.0 has been released as the final version written in JavaScript before the transition to the Go-based Project Corsa in version 7.0. This release defaults to strict mode and esnext modules, promising 20-50% speed improvements for existing projects. Early reports from VS Code engineers indicate that the new compiler architecture reduced their type-check times from 77 seconds to just 7.5 seconds. <a href="https://app.daily.dev/feed-by-ids?id=2TBDrCEMI&amp;id=fwC1fC7w1" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Microsoft open sources massive Rust training curriculum</strong>: A comprehensive seven-book series covering everything from C++ transitions to expert-level type-driven correctness is now available on GitHub. <a href="https://app.daily.dev/posts/xssoc0xIN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>FineTune Studio brings local LLM training to Apple Silicon</strong>: This open-source Electron app uses the MLX framework to fine-tune models locally with live loss curves and GGUF export support. <a href="https://app.daily.dev/posts/2wHulArKB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Unreal MCP server enables AI control of UE5</strong>: A new open-source Model Context Protocol server allows Claude and other assistants to manage assets and gameplay systems via a C++ bridge. <a href="https://app.daily.dev/posts/9UFaZJKaA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>React2AWS generates Terraform from JSX components</strong>: Developers can now define AWS infrastructure using React-like syntax and Tailwind-inspired classes to export modular Terraform projects. <a href="https://app.daily.dev/posts/YqbhLHTeP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WinApp CLI unifies Windows dev for Rust and Electron</strong>: Microsoft’s new tool simplifies environment setup and package identity management across .NET, C++, and Rust workflows. <a href="https://app.daily.dev/posts/Y5SIfePPI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GLM 5.1 dominates agentic benchmarks but fails at chat</strong>: The new model from ZAI ranks second on agentic leaderboards, outperforming Codex, though it struggles with basic conversational tasks. <a href="https://app.daily.dev/posts/7TgN9vkuJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ubuntu proposal to strip GRUB features faces backlash</strong>: Canonical engineers want to remove support for LVM, LUKS, and ZFS in signed GRUB builds to reduce the pre-boot attack surface. <a href="https://app.daily.dev/posts/XPJSKIrCG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The great Copilot data heist</strong>: GitHub is ‘generously’ opting all individual users into training their models on your private data by default starting April 24. While they claim it’s ‘industry standard,’ they conveniently exempted high-paying Enterprise users who actually have lawyers. If you don’t want your clever hacks becoming public training data, you have to go hunt for the opt-out toggle yourself. <a href="https://app.daily.dev/feed-by-ids?id=HCBJz5C1C&amp;id=4ps31zSby" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Compliance theater at LiteLLM</strong>: LiteLLM, the darling of AI gateways, was caught with credential-harvesting malware while proudly displaying SOC2 and ISO 27001 badges. It turns out their auditor, Delve, is under fire for allegedly faking audit data to make startups look secure. It’s a perfect reminder that a security certificate is just a JPEG if your dependencies are a dumpster fire. <a href="https://app.daily.dev/posts/auXgHVyo4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding and the death of quality</strong>: The industry is currently obsessed with ‘vibe coding,’ a fancy term for letting AI vomit out generic, undifferentiated landing pages. Critics correctly point out that reducing the effort barrier to zero just floods the web with low-effort garbage that lacks any architectural integrity. We’re trading system design for ‘vibes,’ and the technical debt will be due sooner than you think. <a href="https://app.daily.dev/feed-by-ids?id=Dsi9u6ERQ&amp;id=bb6i7HLyS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
