Code Monkey

Coding with Lewis

daniel.haxx.se

Debezium

Docker

InfoWorld

<h2>Must know</h2>
<ul>
<li><strong>Cybersecurity landscape worsens with AI-enabled attacks</strong>: CrowdStrike’s 2026 Global Threat Report indicates a dramatically worsening cybersecurity landscape, with average cyberattack breakout time dropping 65% to 29 minutes. AI-enabled attacks surged by 89%, integrating Generative AI across the attack kill chain, and 82% of detections were malware-free, signaling a shift towards stealthy persistence. This highlights the urgent need for broad system instrumentation and proactive threat hunting, as reported by CrowdStrike. <a href="https://app.daily.dev/posts/WsqeDq8OW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>npm supply chain attack targets CI pipelines and AI coding tools</strong>: Socket researchers uncovered the SANDWORM_MODE npm supply chain attack campaign, involving at least 19 typosquatted packages impersonating developer utilities and AI coding tools like Claude Code. The malware harvests sensitive credentials and injects malicious code into repositories and CI pipelines via weaponized GitHub Actions. It also deploys a malicious MCP server for prompt-injection attacks against AI coding assistants, silently exfiltrating SSH keys and cloud credentials, as detailed by InfoWorld. <a href="https://app.daily.dev/feed-by-ids?id=q6c2RLQKH&amp;id=3fX3MdYNS" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Meta secures major AMD chip deal for AI expansion</strong>: Meta signed a multiyear deal with AMD to purchase up to $100 billion worth of chips, including MI540 GPUs and the latest CPUs, aiming to add 6GW of data center compute capacity. This move is part of Meta’s strategy to diversify its AI compute stack beyond Nvidia and accelerate the development of cutting-edge AI models, with a performance-based warrant from AMD to Meta contingent on AMD’s stock reaching $600. <a href="https://app.daily.dev/posts/vYZNsZv8f" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI agents accelerate feature development on personal site</strong>: Kent C. Dodds reported using AI agents, specifically Cursor, to rapidly implement features like semantic search and keyboard shortcuts on his personal site, clearing his GitHub issues backlog since 2019. <a href="https://app.daily.dev/posts/HVH19Oob1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor launches autonomous cloud AI agents for software development</strong>: Cursor launched cloud agents that enable autonomous software development in isolated virtual machines, capable of producing merge-ready Pull Requests with video and screenshot artifacts, and running multiple long-running tasks in parallel. <a href="https://app.daily.dev/posts/BbESdM4Ct" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Apple researchers introduce on-device AI model ferret-UI lite</strong>: Apple researchers introduced Ferret-UI Lite, a lightweight 3B-parameter multimodal AI model designed to understand and interact with user interfaces directly on-device, prioritizing low latency, privacy, and offline capability. <a href="https://app.daily.dev/posts/qj9GoBvQx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New LLM inference technique triples speed</strong>: Researchers developed a multi-token prediction technique that triples LLM inference speed without auxiliary draft models, achieving 3x+ speedup with under 3% accuracy loss on reasoning-heavy workloads by fine-tuning models with a confidence-adaptive decoding strategy. <a href="https://app.daily.dev/posts/hxaAjvILy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Discord corporate security risks highlighted</strong>: Discord’s growing use by SaaS and dev teams introduces significant security risks, with employees sharing sensitive data outside IT governance, making it a target for token theft and malware like VVS Stealer, as highlighted by an article on corporate security. <a href="https://app.daily.dev/posts/wMk4m1adF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Private Kubernetes for enterprise hybrid cloud portability</strong>: Private Kubernetes serves as a vendor-neutral abstraction layer, enabling workload portability across on-prem, private, and public cloud environments without code rewrites, addressing common hybrid cloud failures through consistent security controls and operational predictability. <a href="https://app.daily.dev/posts/j1OYXy6B1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Elasticsearch v9.2.1 performance gains for vector search</strong>: Trendyol’s load tests show Elasticsearch v9.2.1 delivers approximately 2x throughput and 50% less CPU usage compared to v8.18.3 for vector search, achieving up to 10x better p99 latency under high concurrency and scaling beyond v8’s capabilities. <a href="https://app.daily.dev/posts/Iw8wLbMFe" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AWS AI tool outage blame controversy</strong>: AWS reported an outage caused by an engineer using Kiro, Amazon’s agentic AI coding tool, accidentally triggering a CloudFormation teardown. AWS framed it as ‘human error’ and Kiro’s involvement as a ‘coincidence,’ which is a convenient way to protect Kiro’s reputation while simultaneously laying off human workers. The fix? Mandatory human peer review for AI-generated changes. So, AI is smart enough to write code, but not smart enough to not break production, and humans are still needed to clean up its messes, even as they’re being replaced. <a href="https://app.daily.dev/posts/qZoHoApRh" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents impact on ‘10x developer’ concept</strong>: Justin Searls, a named individual, claims AI agents have rendered the ‘10x developer’ debate moot, effectively equalizing or amplifying developer output across the board. This is a bold claim from a single source, conveniently ‘nailing’ his own prediction without providing any actual evidence or details on how this magical equalization occurs. It sounds more like wishful thinking or a self-congratulatory pat on the back than a rigorous analysis of AI’s impact. <a href="https://app.daily.dev/posts/dMpIU74OH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Satirical rejection of AI-generated content in open source</strong>: A satirical RFC-style document, ‘RAGS’ (Rejection of Artificially Generated Slop), was published as a mock rejection notice for AI-generated contributions to open-source projects. It identifies ‘AI slop’ through signs like hallucinated APIs and boilerplate commit messages, proposing mock punitive measures. It’s a humorous take, but it perfectly captures the growing frustration of maintainers dealing with the deluge of low-quality, AI-generated garbage. Apparently, even AI can’t escape the ‘bullshit police’ when it comes to open source contributions. <a href="https://app.daily.dev/posts/ShjQbEues" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
