<h2>Must know</h2>
<ul>
<li><strong>Massive supply chain attack hits Axios npm package</strong>: A sophisticated compromise of the <code>axios</code> package, downloaded 100 million times weekly, has delivered a cross-platform Remote Access Trojan via a hijacked maintainer account. According to Socket and StepSecurity, the malicious versions (1.14.1 and 0.30.4) bypass CI/CD workflows and use a self-destructing dependency to evade detection. If you’ve updated recently, rotate all credentials and check for the <code>plain-crypto-js</code> directory immediately. <a href="https://app.daily.dev/posts/RlEVDfzaA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel flips the switch on default CDN caching</strong>: Starting April 6th, Vercel will automatically honor upstream cache headers for all new projects using rewrites to external origins. This is a major departure from the previous ‘uncached by default’ behavior and could lead to stale data if your origin headers aren’t strictly managed. Existing projects are safe for now but can opt-in via the dashboard, as detailed in Vercel’s latest product update. <a href="https://app.daily.dev/posts/8PlWagtQs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical RCE and memory leaks in Citrix and Fortinet</strong>: A wave of active exploitations is targeting Citrix NetScaler (CVE-2026-3055) and Fortinet BIG-IP (CVE-2025-53521), with the latter reclassified as a critical 9.8 RCE bug. Researchers at watchTowr report that attackers are already leaking session tokens and credentials from exposed identity paths. The NCSC and CISA have issued urgent calls to patch these gateway devices as they are being hit within days of disclosure. <a href="https://app.daily.dev/feed-by-ids?id=Kggs3GauU&amp;id=3gdEh2jrM" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>QuickBEAM brings a native TypeScript toolchain to the Erlang VM</strong>: This new runtime integrates JS contexts as GenServers within OTP, using Rust-based NIFs to bypass Node.js entirely for SSR and agent orchestration. <a href="https://app.daily.dev/posts/kcgZ3hVcU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>C# 14 breaks the this barrier with extension blocks</strong>: The new syntax allows developers to define static members and properties on types they don’t own, making shared libraries feel more like native APIs. <a href="https://app.daily.dev/feed-by-ids?id=REHm0dCIj&amp;id=lMvpe8YLm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Turborepo 2.9 achieves 96 percent faster task computation</strong>: By parallelizing lockfile parsing and replacing git subprocesses with gix-index, cold start times on large monorepos dropped from 8 seconds to 716ms. <a href="https://app.daily.dev/posts/DXD2CTDRc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare opens AI powered client side security to everyone</strong>: The system uses Graph Neural Networks to analyze JavaScript ASTs, claiming a 200x reduction in false positives for detecting malicious scripts. <a href="https://app.daily.dev/posts/54dlhvQ2T" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>C++26 reflection overhead is mostly just header bloat</strong>: Early benchmarks show the reflection flag itself has zero cost, but including the meta header adds 155ms, making precompiled headers mandatory for scale. <a href="https://app.daily.dev/posts/0P40yGjv1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest migrates PyTorch to 2.6 with zero downtime</strong>: The ML team successfully navigated a full stack upgrade from Ubuntu 20 to 24 while resolving TorchScript deadlocks and Caffe2 deprecation issues. <a href="https://app.daily.dev/posts/36SNid6PL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Lightricks releases LTX-2 open source 4K video model</strong>: The Apache 2.0 licensed model features 19 billion parameters and runs on consumer GPUs like the RTX 3060 for a fraction of Sora’s cost. <a href="https://app.daily.dev/posts/HGgaXsrmk" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>GitHub Copilot is now an ad network for your PRs</strong>: Users are reporting that Copilot is ‘helpfully’ inserting promotional ads for itself and Raycast into pull request descriptions when asked to fix simple typos. It’s a bold move to take the ‘enshittification’ speedrun record by turning a paid developer tool into a billboard for its own ecosystem. If I wanted unsolicited marketing in my git history, I’d just open my project to low-quality AI-generated spam from the general public. <a href="https://app.daily.dev/feed-by-ids?id=CBiU6JMgV&amp;id=D0DAOzcJD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The dream of spec driven development is just waterfall with a prompt</strong>: A new wave of ‘four pillar’ frameworks claims we can solve the AI intent gap by frontloading every thought into machine-readable Markdown ‘specs.’ This ignores the last 40 years of engineering reality where complexity is discovered during implementation, not in a pre-code vibes session. It’s essentially asking developers to write the code twice—once in a brittle pseudo-language and once via an agent that will probably hallucinate the edge cases anyway. <a href="https://app.daily.dev/feed-by-ids?id=Asddc9m74&amp;id=y0nJOt8D2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents are breaking the internet and your sleep schedule</strong>: Recent reports blame AI for everything from a 19 percent spike in weekend commits to Amazon’s Kiro AI accidentally deleting entire production environments. While the hype says agents make us 10x faster, the data suggests they just double the PR volume and leave senior engineers to spend 91 percent more time fixing ‘soulless’ AI slop. We aren’t shipping faster; we’re just generating technical debt at the speed of light and calling it productivity. <a href="https://app.daily.dev/feed-by-ids?id=iNM3exNAC&amp;id=almRz4n6M&amp;id=W1h9sUtgn" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
