<h2>Must know</h2>
<ul>
<li><strong>Android sideloading gets a 24 hour cooling off period</strong>: Google is introducing a high-friction ‘advanced flow’ for installing unverified APKs that forces users to enable developer mode and wait a full day before installation. While framed as a security measure for the 2026 rollout, it effectively kills the ‘install and go’ experience for third-party apps while exempting ADB-based sideloading. This change coincides with stricter developer verification for hobbyist accounts, which will soon be capped at just 20 devices. <a href="https://app.daily.dev/feed-by-ids?id=Gi3QvqmhE&amp;id=KfR20YBV2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical RCE vulnerability in Langflow framework</strong>: CISA has issued a warning for CVE-2026-33017, a critical flaw in the Langflow low-code framework that allows unauthenticated remote code execution via a single POST request. The vulnerability stems from passing attacker-controlled data directly into Python’s exec() function, potentially exposing sensitive API keys and CI/CD pipelines. Users are urged to upgrade to version 1.9.0 immediately to prevent lateral movement within their infrastructure. <a href="https://app.daily.dev/posts/vNn8UUgk6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>White House Android app caught stripping GDPR banners</strong>: A technical decompile of the official White House app revealed it injects custom JavaScript to bypass cookie consent and paywalls on third-party sites. The analysis also found a GPS tracking pipeline that polls location every few minutes and a supply chain risk involving YouTube embeds loaded from a personal GitHub account. Despite claims of privacy, the app appears to profile users extensively using non-government third-party SDKs. <a href="https://app.daily.dev/posts/luKGADzaQ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>PostgreSQL 19 adds native NDJSON support for COPY TO</strong>: The new native implementation is faster and more memory-efficient than previous subquery workarounds for exporting data. <a href="https://app.daily.dev/posts/A8rY0NDuu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Virtual clusters slash Kubernetes control plane overhead</strong>: Tools like vCluster and Kamaji allow teams to run tenant control planes as pods, potentially saving tens of thousands in managed EKS fees. <a href="https://app.daily.dev/posts/LZn0volzl" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pretext library enables DOM free text layout</strong>: This pure TypeScript library uses Canvas for measurement to calculate paragraph heights and line breaks without triggering expensive browser reflows. <a href="https://app.daily.dev/posts/HTzI8mpcv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux 7.0 rc6 receives major EXT4 stability fixes</strong>: Ted Ts’o submitted a large batch of fixes addressing use-after-free bugs, memory leaks, and deadlock races found via Syzkaller. <a href="https://app.daily.dev/posts/MLFTfZ0d9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>System76 refreshes Thelio Mira with liquid cooling</strong>: The 2026 Linux desktop redesign features a milled metal chassis and significant thermal improvements, though it still lacks a built-in card reader. <a href="https://app.daily.dev/posts/M4XuRar1x" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Room 3.0 alpha goes coroutine first for KMP</strong>: The latest release introduces full Kotlin Multiplatform support for JS and Wasm while strictly enforcing non-blocking API calls. <a href="https://app.daily.dev/posts/Gi3QvqmhE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open source Civilization 1 rewrite hits .NET 8</strong>: The OpenCiv1 project has successfully reverse-engineered the 1991 DOS original into cross-platform C# using the Avalonia UI framework. <a href="https://app.daily.dev/posts/9LIrsQu05" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Atlassian is firing people to fund its pivot to hype</strong>: Atlassian is cutting 1,600 humans to ‘self-fund’ its transition into the latest tech trend, despite their stock being down 84% from its peak. CEO Mike Cannon-Brookes claims it’s about ‘skill mix,’ which is corporate-speak for replacing expensive engineers with the hope that their Rovo features can eventually write Jira tickets for them. It’s a classic restructuring play disguised as a forward-looking investment in a sector currently obsessed with anything but headcount. <a href="https://app.daily.dev/posts/YwPJVwdRf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The 24 hour sideloading wait is not a win for power users</strong>: Some outlets are calling Google’s new high-friction sideloading process a ‘win’ because it technically still exists, ignoring the mandatory 24-hour cooling-off period. Forcing a developer to wait a full day to test an APK on their own hardware isn’t a feature; it’s a deliberate hurdle designed to nudge users back toward the safety of the Play Store. If your ‘win’ involves more bureaucracy and less agency over your device, you’re just losing slower than everyone else. <a href="https://app.daily.dev/posts/KfR20YBV2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>M and A success is apparently just a matter of vibes</strong>: Palo Alto Networks CEO Nikesh Arora claims purchase price is an ‘irrelevant artifact’ and that the secret to 70% success is just making the acquired founders the boss of his own unhappy teams. While it sounds visionary in a LinkedIn post, ignoring the price tag is a luxury only available when you have a 3,000-person sales force to brute-force growth. It’s easy to say the roadmap is all that matters when you’re operating with the kind of capital that makes ‘expensive’ a relative term. <a href="https://app.daily.dev/posts/jSXgzq05A" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
