<h2>Must know</h2>
<ul>
<li><strong>AI code generation is a debt multiplier</strong>: New analysis from The Engineering Manager warns that LLMs are accelerating the propagation of flawed design decisions and incorrect requirements. Because AI excels at rapid pattern-matching but lacks deliberate strategic reasoning, the ‘slow phases’ of development—requirements and architectural design—are now more critical to prevent automated technical debt. Clean Code is More Important than Ever notes that LLMs blindly replicate outdated or messy patterns, making strict adherence to intentional coding standards a prerequisite for using these tools safely. <a href="https://app.daily.dev/feed-by-ids?id=TVLYNeaho&amp;id=qTviRDoGT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical RCE in Langflow framework</strong>: CISA has issued a warning for CVE-2026-33017, a critical vulnerability in the Langflow AI agent framework with a CVSS score of 9.3. According to AI Cyber Insights, the flaw allows unauthenticated remote code execution by passing attacker-controlled data directly to Python’s exec() function. Users are urged to upgrade to version 1.9.0 immediately to prevent the exfiltration of cloud API keys and potential supply chain attacks via connected CI/CD pipelines. <a href="https://app.daily.dev/posts/vNn8UUgk6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Depot CI launches to solve AI scale bottlenecks</strong>: Depot has released Depot CI, a programmable engine designed to handle the massive increase in commit volume driven by AI agents. As reported by Tech Lead Digest, the system uses a custom orchestration layer called Switchyard to provide prewarmed runners and checkpoint replay, claiming significantly faster start times than traditional CI providers. It maintains GitHub Actions compatibility while offering deeper CPU/memory metrics and programmatic execution control. <a href="https://app.daily.dev/posts/v4e7ugFs8" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>QuickBEAM brings JS runtimes to the Erlang VM</strong>: A new runtime integrates JavaScript contexts as GenServers within OTP supervision trees, supporting native DOM and TypeScript via Rust NIFs. <a href="https://app.daily.dev/posts/kcgZ3hVcU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Apache Flink CDC 3.6.0 adds Oracle and Hudi support</strong>: The release includes Flink 2.2.x support, PostgreSQL schema evolution, and critical bug fixes for MySQL binlog data loss scenarios. <a href="https://app.daily.dev/posts/SIRicutSR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Universal LLM client liter-llm targets supply chain safety</strong>: Built in Rust with 11 language bindings including Go, this client replaces Python-heavy alternatives with a focus on observability and secret management. <a href="https://app.daily.dev/posts/2yHoir3TW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubescape adds MCP server for AI security queries</strong>: The CNCF security platform now allows AI assistants to query Kubernetes cluster posture using natural language via the Model Context Protocol. <a href="https://app.daily.dev/posts/F94MZ4tkx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Category theory maps the core of DataFrames</strong>: Research shows that complex DataFrame operations boil down to an adjoint triple from category theory, enabling safer query optimization in typed languages. <a href="https://app.daily.dev/posts/8ysZKNVTx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AyaFlow provides sidecarless eBPF networking in Rust</strong>: This lightweight traffic analyzer uses TC hooks to capture kernel-native events with minimal overhead and exports Prometheus metrics. <a href="https://app.daily.dev/posts/3CYRrGb60" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DOOM rendered entirely with CSS transforms</strong>: A technical feat using CSS 3D transforms and trig functions to handle rendering, leaving JavaScript only for the basic game loop. <a href="https://app.daily.dev/posts/1KfzJqNuq" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The Azure Copilot Migration Agent is a glorified PDF reader</strong>: Microsoft is hyping an ‘AI agent’ to accelerate cloud migration, but InfoQ notes it currently can’t actually execute migrations. It’s essentially a chatbot that looks at your VMware setup and points you toward the same documentation you were already reading, while the actual heavy lifting remains manual. <a href="https://app.daily.dev/posts/25eJWn6ov" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DeepSeek benchmarks are currently fan fiction</strong>: SitePoint is comparing DeepSeek-R2 to GPT-4o, but the catch is that the R2 figures are ‘forward-looking projections’ rather than actual measured results. Comparing a real model to a hypothetical one is a bold strategy for anyone interested in actual engineering data rather than marketing hype. <a href="https://app.daily.dev/posts/FiMuYZXRT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe hacking is just the new word for script kiddies</strong>: The industry is trying to make ‘vibe hacking’ a thing to describe people using AI to automate basic pentesting tools. David Bombal’s coverage highlights how AI is lowering the barrier, but let’s be honest: calling an automated DDoS a ‘pincer movement’ doesn’t make it any less of a basic volumetric attack. <a href="https://app.daily.dev/posts/rGRAHP59w" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
