<h2>Must know</h2>
<ul>
<li><strong>Axios and Telnyx hit by sophisticated supply chain attacks</strong>: The ubiquitous <code>axios</code> npm package (100M+ weekly downloads) was compromised after an attacker hijacked a lead maintainer’s credentials to inject a cross-platform Remote Access Trojan via a fake dependency. Simultaneously, the Telnyx Python SDK on PyPI was poisoned with a multi-stage infostealer that executes via a disguised .wav file, according to reports from Socket and TeamPCP. If you’ve pulled <code>axios@1.14.1</code> or <code>0.30.4</code>, rotate all API and SSH keys immediately and check for the <code>plain-crypto-js</code> directory in your node_modules. <a href="https://app.daily.dev/feed-by-ids?id=RlEVDfzaA&amp;id=7FoDJB6WK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel and Turborepo overhaul caching and task graphs</strong>: Vercel is flipping the default CDN behavior on April 6th to automatically honor upstream cache headers for rewrites to external origins, a move announced to simplify edge caching for new projects. On the build side, Turborepo 2.9 has achieved a 96% speedup in task graph computation by parallelizing filesystem walks and replacing git subprocesses with <code>gix-index</code>. These optimizations, detailed by Vercel engineers, reduced ‘Time to First Task’ on massive monorepos from 8 seconds to under 720 milliseconds. <a href="https://app.daily.dev/feed-by-ids?id=8PlWagtQs&amp;id=DXD2CTDRc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical RCE in ruby-lsp and session hijacking in MCP Ruby SDK</strong>: A CVSS 9.8 vulnerability (CVE-2026-34060) was disclosed in the <code>ruby-lsp</code> gem, allowing arbitrary code execution via unsanitized VS Code workspace settings. Additionally, the MCP Ruby SDK (v0.9.1 and below) suffers from a high-severity session hijacking flaw in its SSE transport implementation that lets attackers intercept real-time tool responses. Security researchers urge immediate updates to <code>ruby-lsp</code> &gt;= 0.26.9 and <code>mcp-ruby-sdk</code> &gt;= 0.9.2 to prevent environment compromise. <a href="https://app.daily.dev/feed-by-ids?id=8EEqrSwoq&amp;id=33YJYa6hE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AMD submits hardware-accelerated vIOMMU patches for Linux 7.1</strong>: The new patches aim to reduce CPU overhead and latency for guest IOMMUs by enabling partial hardware acceleration. <a href="https://app.daily.dev/posts/vZE44shTF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Tekton reaches CNCF incubation as Kubernetes-native CI/CD matures</strong>: The framework now treats pipelines as standard K8s resources, integrating deeply with Argo CD and Sigstore for supply chain security. <a href="https://app.daily.dev/posts/MPEdmrhRi" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare opens AI-powered client-side security to self-serve users</strong>: The system uses Graph Neural Networks and LLMs to analyze JavaScript ASTs, reportedly reducing false positives by 200x. <a href="https://app.daily.dev/posts/54dlhvQ2T" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest migrates ML stack to PyTorch 2.6 with zero downtime</strong>: The cross-stack upgrade involved moving GPU hosts to Ubuntu 24 and resolving TorchScript deadlocks by disabling JIT profiling. <a href="https://app.daily.dev/posts/36SNid6PL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Discord open sources Osprey safety engine for high-concurrency rules</strong>: The Rust-based coordinator evaluates 2.3 million rules per second using Python worker nodes and an AST-based DSL. <a href="https://app.daily.dev/posts/c0Z9GNgQz" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>EU Cyber Resilience Act mandates SBOMs and secure boot for IIoT</strong>: Effective March 30, the act requires hardware root of trust and mTLS for all connected edge devices in the European market. <a href="https://app.daily.dev/posts/TWMmb9ahZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ClickHouse targets AI agents with new Agentic Data Stack</strong>: The architecture integrates ClickHouse with Model Context Protocol (MCP) and Langfuse for agent-driven observability. <a href="https://app.daily.dev/posts/n13wVsPjg" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>GitHub Copilot is now a billboard for your PRs</strong>: Users are reporting that Copilot is ‘helpfully’ inserting promotional ads for itself and Raycast directly into pull request descriptions when asked to fix simple typos. It’s a bold move to turn a paid productivity tool into an ad-supported experience, perfectly illustrating the ‘enshittification’ of developer workflows. If you wanted your code reviews to look like a recipe blog, Microsoft has you covered. <a href="https://app.daily.dev/feed-by-ids?id=CBiU6JMgV&amp;id=D0DAOzcJD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The U-shaped productivity curve of AI coding</strong>: While hype-men claim AI gives an 80% speed boost, the 2026 DORA report confirms that for real-world architectural complexity, productivity actually drops below the baseline. We’re trading deep system understanding for ‘AI slop’ PRs that senior engineers now spend 91% more time reviewing and fixing. It turns out that generating 1,000 lines of code you don’t understand isn’t actually ‘engineering.’ <a href="https://app.daily.dev/feed-by-ids?id=y0nJOt8D2&amp;id=1zqOxMQPJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Elon Musk thinks compilers are going extinct</strong>: Musk recently claimed that LLMs will make compilers and programming languages obsolete, apparently forgetting that machines still don’t run on ‘vibes.’ In reality, structured, type-safe languages like Rust are becoming <em>more</em> important because they provide the only rigorous feedback loop that keeps hallucinating agents from bricking production. Betting on English as the ultimate systems language is a great way to ensure your ‘autonomous’ car hallucinates a stop sign as a suggestion. <a href="https://app.daily.dev/posts/4uc7pjBZI" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
