<h2>Must know</h2>
<ul>
<li><strong>Laravel Cloud launches programmable API and CLI</strong>: Laravel has released a fully programmable REST API and CLI for its Cloud platform, enabling automated management of deployments, databases, and scaling. This update is particularly impactful for CI/CD pipelines and AI agents, which can now provision resources like databases or check instance counts programmatically. Additionally, Laravel Forge now supports MySQL 9.x, while the framework itself gained a new Svelte starter kit with Inertia integration. <a href="https://app.daily.dev/feed-by-ids?id=VdpPnPzs7&amp;id=BrFOlId9r" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical security patches for Angular and Django</strong>: Google’s Angular team released urgent patches for two SSR vulnerabilities, including a critical SSRF flaw that allows attackers to steal Authorization headers and session cookies. Simultaneously, Django issued security updates (6.0.3, 5.2.12, 4.2.29) to address a DoS vulnerability in URLField and a race condition affecting file system permissions. Developers using these frameworks are urged to update immediately to mitigate remote code execution and data theft risks. <a href="https://app.daily.dev/feed-by-ids?id=uyb72ug6C&amp;id=vB3tALZkk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>North Korean StegaBin attack targets developer credentials</strong>: A new supply chain campaign dubbed ‘StegaBin’ by the Famous Chollima group has been detected using 26 malicious npm packages that typosquat popular libraries. The malware uses Pastebin steganography to deploy a multi-stage infostealer targeting SSH keys, git credentials, and VSCode configurations across Linux, Windows, and macOS. Web3 and cryptocurrency developers are the primary targets of this sophisticated evasion effort, which uses RC4 encryption and Vercel routing to hide C2 traffic. <a href="https://app.daily.dev/posts/QDsiIqiel" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Vite powered npmx registry browser enters alpha</strong>: VoidZero is sponsoring npmx, a new high-performance registry browser built on Vite and Rolldown that recently fixed a 3x postinstall script slowdown. <a href="https://app.daily.dev/posts/fKu9ebwYx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js 25.8.0 adds SQLite limits and permission auditing</strong>: The latest release introduces a limits property for DatabaseSync, a --permission-audit flag, and worker ID exposure for better concurrent test execution. <a href="https://app.daily.dev/posts/RjnXphTRh" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Portless replaces numeric localhost ports with named URLs</strong>: This new npm tool provides stable .localhost URLs with auto-generated trusted HTTPS certificates, eliminating port conflicts in monorepo setups. <a href="https://app.daily.dev/posts/iplbny8Oe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Zephir offers C performance for PHP extensions</strong>: A PHP-like language that compiles to C, Zephir allows developers to write high-performance extensions with familiar syntax, reducing page loads from 800ms to 300ms. <a href="https://app.daily.dev/posts/RVvRweQSv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spatie Crawler v9 introduces fluent API and adaptive throttling</strong>: The popular PHP package now features a driver-based JS renderer and a fake() method for unit testing without making real HTTP requests. <a href="https://app.daily.dev/posts/SdvyfwQLs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google launches Gemini 3.1 Flash Lite for high volume tasks</strong>: Priced at $0.25 per million input tokens, this model targets data processing workloads with speeds up to 363 tokens per second. <a href="https://app.daily.dev/posts/z8znwLLdC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust iterator abstraction causes 60x slowdown in Turbopuffer</strong>: A performance post-mortem revealed that recursive next() calls prevented vectorization, requiring a shift to batched iterators to recover 170ms of latency. <a href="https://app.daily.dev/posts/U3pwVYd72" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The death of DevOps according to Cognition Lab</strong>: Cognition Lab is claiming that human DevOps engineers are now ‘the exception rather than the default’ because their Devin AI agent is so good. It’s a bold marketing pivot for a tool that mostly excels at junior-level benchmarks, yet they’re framing it as a total industry displacement. Expecting a CLI tool to replace entire infrastructure teams is the kind of ‘vibe coding’ logic that falls apart the moment a real production incident hits. <a href="https://app.daily.dev/posts/LfBawqtwk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Two tier valuations for AI unicorns</strong>: Startups like Aaru and Serval are reportedly using ‘headline’ valuations to claim unicorn status while lead VCs actually buy in at less than half that price. It’s a desperate branding exercise designed to trick talent and customers into thinking the company is worth $1B when the blended math says otherwise. This is classic bubble behavior that creates massive pressure for future rounds that these companies likely won’t be able to justify. <a href="https://app.daily.dev/posts/cRCbCFvQ5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The AI information war and fake revenue</strong>: Critical analysis suggests OpenAI and Anthropic are leaking selective, inconsistent financial projections to maintain investor hype despite massive losses. Claims of $13bn in revenue are being scrutinized as potentially misleading, while Anthropic’s ‘safety’ stance is looking increasingly performative given their recent military contract disputes. It’s a high-stakes shell game where the only thing being ‘disrupted’ is the transparency of Silicon Valley accounting. <a href="https://app.daily.dev/posts/egxeYRWKg" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
