<h2>Must know</h2>
<ul>
<li><strong>Axios and Telnyx hit by sophisticated supply chain attacks</strong>: Malicious versions of the ubiquitous <code>axios</code> npm package (1.14.1 and 0.30.4) were published after an attacker hijacked a lead maintainer’s credentials to inject a Remote Access Trojan. Simultaneously, the Telnyx Python SDK on PyPI was poisoned with a multi-stage infostealer that executes via a disguised .wav file. Socket and StepSecurity report these as highly sophisticated operations bypassing standard CI/CD workflows, requiring immediate credential rotation for anyone who pulled these versions. <a href="https://app.daily.dev/feed-by-ids?id=RlEVDfzaA&amp;id=7FoDJB6WK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel flips the switch on default CDN caching</strong>: Starting April 6th, Vercel will change its default behavior to automatically honor upstream cache headers for responses proxied via rewrites to external origins. Previously, these were uncached by default, but the new standard will respect <code>Cache-Control</code> and <code>Vercel-CDN-Cache-Control</code> for all new projects. Infrastructure engineers should audit upstream headers now to avoid accidental caching of sensitive or dynamic data once the rollout hits. <a href="https://app.daily.dev/posts/8PlWagtQs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical RCE in ruby-lsp and NetScaler exploitation</strong>: A CVSS 9.8 vulnerability (CVE-2026-34060) in the <code>ruby-lsp</code> gem allows arbitrary code execution via unsanitized VS Code workspace settings, necessitating an immediate update to version 0.26.9. Meanwhile, Citrix NetScaler devices are facing active exploitation of CVE-2026-3055, a memory read flaw that leaks session tokens. Security researchers at watchTowr confirm reconnaissance traffic is spiking, placing these at the top of the patching priority list. <a href="https://app.daily.dev/feed-by-ids?id=8EEqrSwoq&amp;id=Kggs3GauU" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Turborepo 2.9 slashes task graph computation time by 96%</strong>: Parallelizing filesystem walks and replacing git subprocesses with gix-index dropped 1,000-package monorepo boot times from 8 seconds to 716ms. <a href="https://app.daily.dev/posts/DXD2CTDRc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AMD readies vIOMMU hardware acceleration for Linux 7.1</strong>: New kernel patches enable partial hardware acceleration for guest IOMMUs, significantly reducing CPU overhead from hypervisor intercepts. <a href="https://app.daily.dev/posts/vZE44shTF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest migrates ML stack to PyTorch 2.6 with zero downtime</strong>: The cross-stack upgrade involved moving GPU hosts to Ubuntu 24 and resolving TorchScript deadlocks by disabling JIT profiling. <a href="https://app.daily.dev/posts/36SNid6PL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>C# 14 introduces extension blocks for cleaner shared libraries</strong>: The new syntax allows defining properties and static members on types you don’t own without the ‘this’ parameter boilerplate. <a href="https://app.daily.dev/posts/REHm0dCIj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Discord open sources Osprey safety engine for high-scale filtering</strong>: The Rust-based coordinator evaluates 2.3 million rules per second, using Python workers to execute a domain-specific language. <a href="https://app.daily.dev/posts/c0Z9GNgQz" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ubuntu 26.04 LTS benchmarks show gains on Zen 5 hardware</strong>: Early testing of the near-final release with Linux 7.0 and GCC 15.2 shows notable performance improvements over version 25.10. <a href="https://app.daily.dev/posts/6OqJFeheh" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Debezium 3.4.3 fixes silent data corruption in PostgreSQL</strong>: The release addresses a critical bug in the pgoutput plugin affecting multibyte UTF-8 table names and improves Oracle LogMiner startup I/O. <a href="https://app.daily.dev/posts/nBeLTF50v" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The Spec-Driven Development pivot is just Waterfall with a prompt</strong>: Hype around ‘Agentic Data Stacks’ and SDD tools like GitHub Spec Kit claims we can frontload all thinking into machine-readable Markdown. This ignores the fundamental reality that software complexity is discovered during implementation, not in a ‘vibes’ session. We’re essentially rebranding the 1990s CASE tools failure for a generation that thinks LLMs can solve the Halting Problem. <a href="https://app.daily.dev/feed-by-ids?id=y0nJOt8D2&amp;id=Asddc9m74" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub Copilot is now an ad-supported IDE</strong>: Users are reporting that Copilot is ‘helpfully’ inserting promotional ads for Raycast and itself directly into PR descriptions when asked to fix typos. Framing this as ‘AI-assisted productivity’ is a stretch when it’s actually just the enshittification of the developer workflow. If I wanted a billboard in my git history, I’d use a free tier from 2005. <a href="https://app.daily.dev/feed-by-ids?id=CBiU6JMgV&amp;id=D0DAOzcJD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Elon Musk thinks compilers are going the way of the dodo</strong>: Musk’s claim that LLMs will make programming languages and compilers obsolete is the ultimate ‘I don’t understand how computers work’ take. As many pointed out, LLMs actually need the rigorous feedback of type-safe languages like Rust to function reliably. Generating machine code directly from a prompt is just a very expensive way to create unfixable, non-deterministic security vulnerabilities. <a href="https://app.daily.dev/feed-by-ids?id=4uc7pjBZI&amp;id=ugSkte7pH" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
