<h2>Must know</h2>
<ul>
<li><strong>North Korean StegaBin campaign targets developer environments</strong>: The Lazarus-linked group Famous Chollima has published 26 malicious npm packages that typosquat popular libraries to deploy a multi-stage infostealer. According to security researchers, the ‘StegaBin’ campaign uses Pastebin steganography to hide command-and-control infrastructure and specifically targets SSH keys, git credentials, and VSCode configurations. Developers working in cryptocurrency or Web3 sectors are the primary targets for this cross-platform RAT that affects Linux, Windows, and macOS. <a href="https://app.daily.dev/posts/QDsiIqiel" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Angular and Django release critical security patches</strong>: Google’s Angular team has issued urgent fixes for a critical SSRF and header injection flaw in Server-Side Rendering that could allow attackers to steal Authorization headers or session cookies. Simultaneously, Django released versions 6.0.3, 5.2.12, and 4.2.29 to address a DoS vulnerability in URLField and a race condition affecting file system permissions. Both teams urge immediate updates to prevent exploitation of these high-severity vulnerabilities in production environments. <a href="https://app.daily.dev/feed-by-ids?id=uyb72ug6C&amp;id=vB3tALZkk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Unity Asset Store to delist all Greater China publishers</strong>: Unity has announced it will remove all assets from publishers based in mainland China, Hong Kong, and Macau from its global store by March 31, 2026. This move is largely attributed to the technical divergence of the ‘Unity China’ forked engine from the main codebase, effectively creating a regional schism. While existing buyers retain access to purchased assets, they will no longer receive updates or publisher support, prompting the community to release scripts for identifying impacted assets. <a href="https://app.daily.dev/posts/HcJsvKbOc" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Kubernetes v1.35 stabilizes in-place Pod resource resizing</strong>: You can now update CPU and memory limits on running containers without restarts, making Vertical Pod Autoscaler finally viable for stateful workloads. <a href="https://app.daily.dev/posts/fjhms6Zq4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Helm 4 replaces legacy plugins with WebAssembly</strong>: The new Wasm-based system offers sandboxed isolation and cross-architecture portability, reportedly reducing plugin latency by up to 40%. <a href="https://app.daily.dev/posts/W9pY3Qv5R" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust iterator abstraction causes 60x slowdown in Turbopuffer</strong>: A deep dive revealed that recursive next() calls prevented compiler vectorization; switching to a batched iterator pattern dropped query latency from 220ms to 47ms. <a href="https://app.daily.dev/posts/U3pwVYd72" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Laravel Cloud launches programmable API and CLI</strong>: The new REST API allows for programmatic management of deployments and databases, specifically designed to enable AI agents to provision infrastructure. <a href="https://app.daily.dev/feed-by-ids?id=BrFOlId9r&amp;id=VdpPnPzs7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Confluent adds Queues for Kafka and A2A protocol</strong>: The platform now supports message queue semantics within Kafka topics (KIP-932) and a new protocol for asynchronous inter-agent communication. <a href="https://app.daily.dev/posts/T0CcYg8af" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Chrome shifts to a two-week release cycle</strong>: Starting September 2026 with version 153, Chrome will accelerate its cadence to ship security fixes and web platform features faster. <a href="https://app.daily.dev/posts/SAMWZskhL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel and AMD submit major Linux kernel driver updates</strong>: Intel is prepping Xe3 graphics support for the 7.1 kernel, while AMD is introducing a new power management interface for Ryzen handhelds. <a href="https://app.daily.dev/feed-by-ids?id=4Tb9y8Q1Y&amp;id=mccLSn0xk" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The two-tier valuation shell game</strong>: AI startups like Aaru and Serval are reportedly using ‘headline’ valuations to claim unicorn status while lead VCs actually buy in at less than half that price. It’s a desperate branding exercise designed to trick talent into joining a company that isn’t actually worth a billion dollars. This mirrors the peak-bubble behavior of 2021, setting these companies up for catastrophic down-rounds when the hype eventually meets reality. <a href="https://app.daily.dev/posts/cRCbCFvQ5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DevOps is dead according to the people selling AI agents</strong>: Cognition Lab is claiming that human DevOps engineers are now ‘the exception rather than the default’ because their Devin agent is so capable. It’s the same tired ‘NoCode’ fantasy rebranded for the LLM era, ignoring the fact that someone still has to debug the agent’s hallucinated infrastructure. If your deployment strategy relies on an AI that was ‘tuned on junior developer benchmarks,’ you haven’t automated DevOps; you’ve just automated technical debt. <a href="https://app.daily.dev/posts/LfBawqtwk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The AI-assisted driver that couldn’t drive</strong>: AMD’s recent RFC for a Linux power management driver was caught using undisclosed AI assistance that resulted in ‘hallucinated tool names’ and garbage code quality. It takes a special kind of confidence to submit AI-generated slop to the Linux kernel mailing list and expect the world’s most pedantic maintainers not to notice. The driver is now being rewritten by actual humans who understand that ‘it compiled’ isn’t a substitute for ‘it works.’ <a href="https://app.daily.dev/posts/mccLSn0xk" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
