<h2>Must know</h2>
<ul>
<li><strong>Laravel and PHP are the future, apparently</strong>: Two companies, Artisan Build and Eupry, are doubling down on Laravel and the TALL stack for their development. Artisan Build is even building a tool to quantify technical debt, while Eupry is migrating its entire decade-old custom PHP codebase to Laravel for better hiring and scalability. This suggests a growing trend towards standardization and framework adoption in the PHP ecosystem, as reported by the Laravel blog.</li>
<li><strong>Supply chain attacks are getting wild</strong>: Multiple high-profile supply chain attacks hit developers, including a phishing scam compromising npm accounts, leading to malware in widely used packages like <code>chalk</code> and <code>debug</code>. Another attack, GhostAction, exploited GitHub Actions to steal credentials from 817 repositories. Even AI-generated code was weaponized, with the NX build system hacked to steal GitHub and npm tokens. Snyk and BleepingComputer confirm these attacks, highlighting the increasing sophistication of threats targeting developer tools and infrastructure.</li>
<li><strong>Android is tightening its grip</strong>: Google is making big moves to control the Android ecosystem. A critical Bluetooth vulnerability (CVE-2025-48539) is being actively exploited, requiring immediate patching. More significantly, Google is mandating developer verification with ID checks and fees for all Android apps by September 2026, even those outside the Play Store. This signals a shift towards a more closed model, similar to Apple’s iOS, as noted by Fatbobman’s Swift Weekly and The Verge.</li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI is transforming software engineering metrics</strong>: Engineering leadership is shifting to a business-focused role, with frameworks like DX Core 4 measuring developer productivity by speed, effectiveness, quality, and impact, emphasizing ROI and communication with non-technical stakeholders.</li>
<li><strong>New AI-powered PDF viewer for Blazor</strong>: Syncfusion launched an AI-powered PDF Viewer for Blazor, enabling smart form filling, intelligent redaction, and semantic search, integrating with Azure OpenAI and other AI services.</li>
<li><strong>Google expands AI capabilities with Gemini and Veo updates</strong>: Google added audio file upload to Gemini, expanded AI Mode in Search to five new languages, and updated Veo 3 video generation models with 50% price reductions and 1080p HD output.</li>
<li><strong>Unity boosts developer resources and launches marketing hub</strong>: Unity released updated free best practices resources for developers and launched Audience Hub, a privacy-first marketing platform using AI for campaign optimization.</li>
<li><strong>New approaches to RAG and vector search</strong>: Tencent launched WeKnora, an open-source LLM framework for RAG, while MariaDB introduced native vector search, and Google released EmbeddingGemma for on-device AI, all focusing on efficient knowledge retrieval.</li>
<li><strong>Web frameworks get updates</strong>: Hugo released version 0.150.0 with module import improvements, Weekly Vue News summarized build time optimizations, and Astro Weekly reported growing adoption by large companies like Travelodge and Renault.</li>
<li><strong>Shopify doubles down on design for AI strategy</strong>: Shopify acquired design studio Molly and reinstated its Chief Design Officer role, emphasizing design as crucial for shaping future AI-powered commerce experiences.</li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated web apps: because we needed more code to debug</strong>: Solid, an AI tool, claims to build ‘production-ready’ full-stack web apps with React, Node.js, and PostgreSQL. Apparently, it’s not just a ‘lovable toy’ like other AI builders. So, instead of writing your own bugs, you can now have an AI write them for you, and then you get to ‘own, deploy anywhere, and extend’ them. Sounds like a real time-saver, especially when you’re trying to figure out why the AI decided to implement that obscure edge case with a <code>goto</code> statement.</li>
<li><strong>Web3 SSH manager: because traditional security was too simple</strong>: Nexion, a ‘next-gen web3 SSH manager,’ replaces traditional SSH keys with crypto wallet authentication and stores server configs on the blockchain. Because nothing says ‘secure’ like tying your server access to a volatile crypto wallet and a distributed ledger that’s constantly being exploited. And it’s ‘OKB-based pricing’ which ‘can reduce costs by up to 95%.’ Sure, until your crypto wallet gets drained or the blockchain decides to fork, then you’ll be paying a lot more than 95% to get your servers back.</li>
<li><strong>SQL limitations: the sky is falling, again</strong>: Infoworld is here to tell us, yet again, that SQL has ‘13 core limitations,’ including issues with large datasets, JOINs, and JSON. They’re pushing document and graph databases as ‘more adaptable and modern.’ It’s almost like they just discovered that different tools are good for different jobs. Next, they’ll probably tell us that hammers aren’t great for screwing in screws. The constant need to declare SQL ‘dead’ is exhausting; it’s a tool, use it where it fits, and stop trying to make it do everything.</li>
</ul>
