<h2>Must know</h2>
<ul>
<li><strong>Axios and Telnyx hit by sophisticated supply chain attacks</strong>: The ubiquitous <code>axios</code> npm package, downloaded 100M times weekly, was compromised via hijacked maintainer credentials to inject a cross-platform Remote Access Trojan. Simultaneously, the Telnyx Python SDK on PyPI was poisoned with a multi-stage infostealer that executes via a disguised .wav file. Security researchers at Socket and StepSecurity warn that these attacks bypassed standard CI/CD workflows, necessitating immediate credential rotation and audits for anyone using these specific versions. <a href="https://app.daily.dev/feed-by-ids?id=RlEVDfzaA&amp;id=7FoDJB6WK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare and Vercel overhaul CDN and client security</strong>: Cloudflare has opened its Client-Side Security Advanced product to self-serve users, utilizing a Graph Neural Network to analyze JavaScript ASTs and reduce false positives by 200x. Meanwhile, Vercel is flipping the default on CDN caching starting April 6th; new projects will automatically honor upstream cache headers for proxied external origins. Developers should review their <code>Cache-Control</code> headers now to avoid unintended caching of dynamic content. <a href="https://app.daily.dev/feed-by-ids?id=54dlhvQ2T&amp;id=8PlWagtQs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android developer verification signals the end of easy sideloading</strong>: Google is rolling out mandatory developer verification across the Play Console, requiring all apps to be registered to avoid aggressive OS-level warnings. Starting in September for select regions and expanding globally by 2027, unregistered apps will require an ‘advanced installation flow’ or ADB, effectively killing seamless sideloading for average users. Google frames this as a 90x reduction in malware risk, though it significantly tightens the ecosystem’s walls. <a href="https://app.daily.dev/posts/Cy65LSf0M" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Turborepo 2.9 slashes task graph computation time by 96%</strong>: By parallelizing filesystem walks and replacing git subprocesses with gix-index, task overhead on large monorepos dropped from 8 seconds to 716 milliseconds. <a href="https://app.daily.dev/posts/DXD2CTDRc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest migrates ML stack to PyTorch 2.6 with zero downtime</strong>: The team managed a full cross-stack upgrade from Ubuntu 20 to 24 and CUDA 12.6, resolving TorchScript deadlocks by disabling JIT profiling. <a href="https://app.daily.dev/posts/36SNid6PL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ubuntu 26.04 LTS benchmarks show major gains on Zen 5</strong>: Early testing of the near-final 26.04 build with Linux 7.0 and Python 3.14 shows notable performance improvements for Ryzen 9000 series hardware. <a href="https://app.daily.dev/posts/6OqJFeheh" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AMD upstreams vIOMMU and AIE4 NPU support to Linux</strong>: New kernel patches enable hardware-accelerated virtualized IOMMU to reduce hypervisor overhead and provide initial support for next-gen Ryzen AI NPUs. <a href="https://app.daily.dev/feed-by-ids?id=vZE44shTF&amp;id=ox9fiekqJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>C# 14 breaks the this barrier with extension blocks</strong>: A new syntax allows developers to define extension properties, static members, and operators for types they don’t own within a clean static block. <a href="https://app.daily.dev/posts/REHm0dCIj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Lightricks releases LTX-2 open source 4K video model</strong>: The 14-billion parameter model runs on consumer GPUs like the RTX 3060 and costs roughly 10% of Sora’s estimated per-minute compute price. <a href="https://app.daily.dev/posts/HGgaXsrmk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Discord open sources Osprey safety rules engine</strong>: The system processes 2.3 million rules per second using a Rust coordinator and Python workers executing a custom DSL. <a href="https://app.daily.dev/posts/c0Z9GNgQz" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>GitHub Copilot is now an ad-supported IDE</strong>: Users are reporting that Copilot is helpfully inserting promotional ads for itself and Raycast directly into their PR descriptions when asked to fix simple typos. It’s a bold move to turn a paid productivity tool into a billboard for other paid tools, perfectly illustrating the ‘enshittification’ of developer workflows. If you wanted your code reviews to look like a recipe blog, Microsoft has you covered. <a href="https://app.daily.dev/feed-by-ids?id=CBiU6JMgV&amp;id=D0DAOzcJD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Elon Musk thinks compilers are going extinct</strong>: Musk recently claimed that LLMs will make compilers and programming languages obsolete, apparently forgetting that machines still don’t run on ‘vibes.’ Industry experts are pointing out that LLMs actually need the rigorous feedback of type-safe languages like Rust to function reliably. Generating machine code directly from a prompt is just a very expensive way to build a system that fails in ways no human can debug. <a href="https://app.daily.dev/posts/4uc7pjBZI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The AI agent productivity U-curve is real</strong>: While marketing teams promise 10x engineering, the 2026 DORA report shows a ‘U-shaped’ productivity curve where AI actually makes complex engineering slower than the baseline. For simple CRUD apps, it’s great; for real-world systems, the ‘last 20%’ of debugging AI-generated hallucinations is eating all the time saved. We’ve successfully automated the easy parts of the job while making the hard parts significantly more annoying. <a href="https://app.daily.dev/feed-by-ids?id=y0nJOt8D2&amp;id=iNM3exNAC" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
