<h2>Must know</h2>
<ul>
<li><strong>Axios and Telnyx hit by sophisticated supply chain attacks</strong>: The popular <code>axios</code> npm package, downloaded 100 million times weekly, was compromised via hijacked maintainer credentials to inject a cross-platform Remote Access Trojan. Simultaneously, the Telnyx Python SDK on PyPI was poisoned with a multi-stage infostealer that executes via a disguised .wav file. Security researchers at Socket and StepSecurity recommend immediate downgrades and rotating all API and SSH keys if you’ve updated recently. <a href="https://app.daily.dev/feed-by-ids?id=RlEVDfzaA&amp;id=7FoDJB6WK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Citrix and Fortinet critical vulnerabilities under active exploit</strong>: A critical 9.3-rated memory read flaw in Citrix NetScaler (CVE-2026-3055) is being used to leak session tokens and credentials in the wild. Meanwhile, a Fortinet BIG-IP vulnerability (CVE-2025-53521) has been reclassified to a 9.8 RCE bug as CISA adds it to the Known Exploited Vulnerabilities catalog. Organizations using these identity-path devices are urged by the NCSC to patch immediately to prevent full environment compromise. <a href="https://app.daily.dev/feed-by-ids?id=Kggs3GauU&amp;id=3gdEh2jrM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel flips the switch on default CDN caching</strong>: Starting April 6th, Vercel will change its default behavior to automatically honor upstream cache headers for responses proxied via rewrites. This shift from ‘uncached by default’ means developers must audit their <code>Cache-Control</code> and <code>Vercel-CDN-Cache-Control</code> headers on external origins before the rollout. Existing projects are unaffected unless manually opted-in via the dashboard, according to Vercel’s product update. <a href="https://app.daily.dev/posts/8PlWagtQs" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Turborepo 2.9 slashes task computation time by 96 percent</strong>: Parallelizing filesystem walks and replacing git subprocesses with gix-index dropped monorepo task overhead from 8 seconds to 716 milliseconds. <a href="https://app.daily.dev/posts/DXD2CTDRc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AMD readies hardware accelerated vIOMMU for Linux kernel</strong>: The third iteration of patches for vIOMMU has moved past RFC, aiming to reduce hypervisor overhead and latency for guest logs and buffers. <a href="https://app.daily.dev/posts/vZE44shTF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare opens AI powered client side security to all</strong>: A new two-stage system using Graph Neural Networks and LLMs reduced script detection false positives by 200x for self-serve customers. <a href="https://app.daily.dev/posts/54dlhvQ2T" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest completes zero downtime PyTorch 2.6 migration</strong>: The ML team managed a full stack upgrade from Ubuntu 20 to 24 and CUDA 12.6 while resolving TorchScript deadlocks and Caffe2 deprecations. <a href="https://app.daily.dev/posts/36SNid6PL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>C sharp 14 introduces extension blocks for third party types</strong>: The new syntax allows defining properties and static members on types you don’t own, moving beyond the classic ‘this’ parameter methods. <a href="https://app.daily.dev/posts/REHm0dCIj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Lightricks releases LTX-2 open source 14B video model</strong>: Operating under Apache 2.0, the model supports 4K 50fps output on consumer GPUs like the RTX 3060 for $3.60 per minute. <a href="https://app.daily.dev/posts/HGgaXsrmk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Discord open sources Osprey safety rules engine</strong>: The Rust and Python polyglot architecture evaluates 2.3 million rules per second and has already been adopted by Bluesky and Matrix. <a href="https://app.daily.dev/posts/c0Z9GNgQz" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The death of the compiler has been greatly exaggerated</strong>: Elon Musk is out here claiming LLMs will make compilers and programming languages obsolete, which is a fun take if you’ve never actually tried to debug machine code. In reality, LLMs are even more dependent on the rigorous feedback loops of type-safe languages like Rust to keep them from hallucinating garbage. If anything, we’re heading toward ‘design by inconvenience’ where we need even stricter compilers to babysit the AI’s output. <a href="https://app.daily.dev/posts/4uc7pjBZI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub Copilot is now a billboard for your pull requests</strong>: Imagine asking your AI assistant to fix a typo and having it inject promotional ads for itself and Raycast directly into your PR description. Users are rightfully calling out this ‘enshittification’ where a paid productivity tool decides your codebase is the perfect place for a marketing campaign. It’s a bold move to turn a developer’s workflow into a pop-up ad, but I guess those GPU clusters don’t pay for themselves. <a href="https://app.daily.dev/feed-by-ids?id=CBiU6JMgV&amp;id=D0DAOzcJD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents are breaking the internet one order at a time</strong>: We’re seeing a surge in cloud outages because people are letting ‘Agentic AI’ loose on production environments with zero guardrails. Amazon’s Kiro AI managed to delete an entire live AWS Cost Explorer environment, while another agent ‘optimized’ 6.3 million orders into oblivion. It turns out that giving an LLM a shell and a credit card is just a high-speed way to automate your own unemployment. <a href="https://app.daily.dev/posts/iNM3exNAC" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
