<h2>Must know</h2>
<ul>
<li><strong>GitHub Copilot starts training on your private data by default</strong>: Starting April 24, 2026, GitHub will begin using interaction data—including code snippets and context—from Copilot Free and Pro users to train its AI models. While Business and Enterprise tiers are exempt, individual developers are automatically opted in and must manually navigate to their account settings to disable this data sharing. This policy change, reported by GitHub and various developer communities, has sparked significant backlash regarding the asymmetry of privacy protections between individual and corporate users. <a href="https://app.daily.dev/feed-by-ids?id=HCBJz5C1C&amp;id=4ps31zSby" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Massive supply chain attack hits Trivy and npm ecosystem</strong>: A threat group known as TeamPCP executed a sophisticated supply chain attack by exploiting GitHub Actions misconfigurations in Aqua Security’s Trivy scanner to steal credentials. This breach allowed the attackers to inject the CanisterWorm malware into multiple npm packages, potentially compromising projects that see over 100 million monthly downloads. Security researchers from Socket and Aqua Security also noted a parallel compromise of the Telnyx Python SDK, which used audio steganography to hide its second-stage payload. <a href="https://app.daily.dev/feed-by-ids?id=EeEZo06er&amp;id=fyhf7Sv5C&amp;id=w52uMMkqR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TypeScript 6.0 arrives as the final JavaScript based release</strong>: TypeScript 6.0 has been released, marking the end of the line for the current JavaScript-based compiler before the transition to the Go-based Project Corsa in version 7.0. This release defaults to strict mode and ES2025 targets, offering 20-50% speed improvements for type-checking, while the upcoming Go-native compiler has already demonstrated a 10x performance gain on the VS Code codebase. Anthropic and Cloudflare are also doubling down on Rust-based tooling to further optimize these high-performance developer workflows. <a href="https://app.daily.dev/feed-by-ids?id=2TBDrCEMI&amp;id=fwC1fC7w1&amp;id=2kRwcIErj" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>GLM 5.1 update claims second place on agentic leaderboards</strong>: ZAI’s latest model shows massive gains in debugging and planning, though it now struggles with basic general chat tasks. <a href="https://app.daily.dev/posts/7TgN9vkuJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Unreal Engine gets a comprehensive MCP server for AI control</strong>: A new open-source Model Context Protocol server allows Claude and other assistants to manage assets and level actors via a C++ bridge. <a href="https://app.daily.dev/posts/9UFaZJKaA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Turbolite enables sub 50ms SQLite queries directly from S3</strong>: This Rust-based VFS uses B-tree-aware page grouping and zstd compression to make S3-hosted databases viable for multi-tenant apps. <a href="https://app.daily.dev/posts/9ZseH6udT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ubuntu proposal to strip GRUB features faces community backlash</strong>: Canonical engineers want to remove support for LVM, LUKS, and ZFS in signed bootloaders to reduce the pre-boot attack surface. <a href="https://app.daily.dev/posts/XPJSKIrCG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>FineTune Studio brings local LLM training to Apple Silicon</strong>: An Electron-based app using the MLX framework simplifies LoRA/QLoRA training with live loss curves on Mac hardware. <a href="https://app.daily.dev/posts/2wHulArKB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PHPantom LSP brings Rust speed to PHP development</strong>: A new language server written in Rust starts in under a second and uses only 59MB of RAM while supporting complex generics. <a href="https://app.daily.dev/posts/lreBnQIWD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DarkSword exploit kit chains six iOS zero days</strong>: A sophisticated kit used by nation-states targets up to 300 million iPhones via drive-by browser attacks, bypassing standard protections. <a href="https://app.daily.dev/feed-by-ids?id=w52uMMkqR&amp;id=pKzzzWmv7" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The Microsoft Copilot branding fever dream</strong>: Microsoft is slapping the ‘Copilot’ label on everything from checkout buttons to PCs in a desperate bid to satisfy shareholder AI metrics. It’s a masterclass in brand dilution where the name now signifies ‘literally any software feature we’ve touched in the last two years.’ If everything is a Copilot, then nothing is, but at least the stock price looks healthy. <a href="https://app.daily.dev/posts/4ps31zSby" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding is just undifferentiated slop with a new name</strong>: The industry is trying to rebrand ‘low-effort AI generation’ as ‘vibe coding,’ which mostly results in generic landing pages that all look identical. It turns out that when you remove the barrier to entry, you just get a flood of digital wallpaper that lacks any actual architectural thought. We’re essentially celebrating the death of craftsmanship in favor of prompt-based mediocrity. <a href="https://app.daily.dev/posts/Dsi9u6ERQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The compliance theater of fake audit data</strong>: LiteLLM is proudly touting SOC2 and ISO certifications obtained through Delve, a startup currently under fire for allegedly generating fake audit evidence. It’s the perfect AI-era irony: using a black-box compliance tool to verify a black-box AI gateway, creating a recursive loop of ‘trust me, bro’ security. We’ve reached a point where the certificate is more important than the actual security posture it’s supposed to represent. <a href="https://app.daily.dev/posts/4ps31zSby" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
