<p><strong>TLDR:</strong> A credential-stealing worm called Miasma compromised 32 official @redhat-cloud-services npm packages on June 1, 2026, affecting roughly 117,000 weekly downloads. The attack started with a compromised Red Hat employee GitHub account, used OIDC tokens to publish backdoored versions with valid SLSA provenance, and self-propagates by stealing tokens to backdoor additional packages. Shopify open-sourced details on GraphQL Cardinal, a breadth-first execution engine delivering 15x faster field execution and 4+ seconds off P50 latency. Apache Kafka 4.3 shipped with 25 KIPs including Kafka Streams header preservation, Share Group controls, and broker isolation.</p>
<hr>
<h2>Miasma worm backdoors 32 Red Hat npm packages via compromised GitHub Actions OIDC, affects 117K weekly downloads</h2>
<p>On June 1, 2026, attackers compromised a Red Hat employee’s GitHub account and injected malicious workflows into RedHatInsights repositories. Those workflows abused GitHub Actions OIDC tokens to publish backdoored versions of 32 packages under @redhat-cloud-services with valid SLSA provenance attestations — making naive provenance checks useless. A 4.2 MB obfuscated preinstall payload sweeps for AWS, GCP, Azure, Kubernetes, HashiCorp Vault, SSH keys, Docker credentials, GitHub Actions secrets, and npm tokens, then self-propagates by republishing backdoored versions using stolen tokens. If you ran npm install on any affected package version, treat that machine as compromised: rotate all CI/CD secrets, cloud credentials, and SSH keys immediately, and audit GitHub for unauthorized repos or workflows with branches named ‘chore/add-codeql-static-analysis’. <a href="https://app.daily.dev/feed-by-ids?id=Q3mbZ24Yd&amp;id=mpTfkMIuW&amp;id=bzd1MUxSa&amp;id=4Kacs0E4h&amp;id=JkIG82lZz&amp;id=jLxGALOM3&amp;id=l4Anv31dE&amp;id=IF43c4tVr&amp;id=Imn47QmZ8&amp;id=suwBrjHCV" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Shopify’s GraphQL Cardinal engine: breadth-first execution delivers 15x faster fields, 4+ seconds off P50 latency</h2>
<p>Shopify replaced depth-first GraphQL traversal with a breadth-first model that batches resolver execution across all objects at the same depth level. The result in production: 15x faster field-level execution, 6x less GC overhead, and over 4 seconds shaved off P50 end-to-end latency for large list queries. The migration preserved full schema and API compatibility — only internal execution orchestration, resolver coordination, and tracing changed. Worth watching if you’re running GraphQL at any meaningful scale. <a href="https://app.daily.dev/posts/0XN3kh03q" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Apache Kafka 4.3 released: record headers in Streams state stores, Share Group controls, broker isolation via log directory cordoning</h2>
<p>Kafka 4.3 lands 25 KIPs and 600+ commits. The headline additions for backend teams: KIP-1271 and KIP-1285 add first-class record header preservation in Kafka Streams state stores, KIP-1240 brings new Share Group configuration controls, and KIP-1066 enables broker isolation by cordoning individual log directories. OAuth client assertion support (KIP-1258) and partition size percentage metrics (KIP-1257) round out the operational improvements. The streams-scala module and classic rebalance protocol are both deprecated, targeting removal in Kafka 5.0. Debezium 3.6.0.Beta1 already ships with the Kafka 4.3 upgrade. <a href="https://app.daily.dev/feed-by-ids?id=tHQzbnVv6&amp;id=7IlArmCNC" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>AWS trailing slash bug bypassed Lambda authorizer authentication entirely, enabled unauthenticated wire transfers in fintech</h2>
<p>A path normalization mismatch in AWS HTTP API means appending a trailing slash to a protected route bypasses the Lambda authorizer completely — the greedy route matching layer and the authorization layer make independent decisions and disagree on what constitutes a match. In a real fintech deployment, this allowed unauthenticated wire transfers. The fix is switching to REST API for stricter path matching and adding independent authorization validation inside each Lambda function. A nearly identical vulnerability class appeared in gRPC-Go as CVE-2026-33186. If you’re using HTTP API with Lambda authorizers, audit trailing-slash variants of every protected route now. <a href="https://app.daily.dev/posts/xCzhPuMsq" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Palo Alto GlobalProtect VPN auth bypass CVE-2026-0257 under active exploitation since May 17, CISA patch deadline was June 1:</strong> PAN-OS trusts decrypted auth override cookie contents without verifying the signature; if the same certificate is shared between HTTPS services and the auth override feature (a common config), an attacker can extract the public key and forge valid cookies to bypass VPN authentication entirely. Patch, disable the feature, or use a dedicated certificate for auth override cookies. <a href="https://app.daily.dev/posts/akuP0u3R2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go file scan: chunked pread with AVX-512 via Go 1.26’s simd/archsimd reaches 49 GB/s, 66x over naive os.ReadFile:</strong> A 13-variant benchmark scanning a 4 GiB file for a non-zero int64 found that mmap underperforms pread at this scale due to 1M+ minor page faults, parallelism beats single-thread SIMD for memory-bound workloads, and Go 1.26’s experimental simd/archsimd package matches hand-written AVX2 assembly with no .s files — the ceiling is DRAM bandwidth at ~50 GB/s on DDR5. <a href="https://app.daily.dev/posts/kK3Qz0ivs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GKE standby buffers: suspended pre-provisioned nodes resume 2-3x faster than cold starts at up to 90% lower cost than overprovisioning:</strong> Available on GKE 1.36.0-gke.2253000+, standby buffers complement active buffers in a two-tier CapacityBuffers API — suspended nodes pay only for disk and IP, resume faster than cold nodes, and Google released an open-source simulator to help size them for target scheduling latency. <a href="https://app.daily.dev/posts/KceXHfSbW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks Liquid Clustering: OPTIMIZE planning on 10 PB tables dropped from 12 hours to 23 minutes versus Hive-style partitioning:</strong> Databricks engineers benchmark Liquid Clustering against Hive partitioning across 8 myths: metadata-only DELETEs run ~90% faster, low-cardinality columns cluster 35% faster with 22% faster queries, and real-world cases at Arctic Wolf (3.8+ PB) and Bolt show significant read/write improvements — with in-place partitioned-to-Liquid conversion coming. <a href="https://app.daily.dev/posts/lxAzrlIPQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js 26.3.0: Buffer.poolSize raised to 64 KiB, macOS x64 downgraded to Tier 2, QUIC improvements land:</strong> The release also adds a permission.drop API, httpValidation option for header value control, and updates root certificates to NSS 3.123.1 — macOS Intel users should note that universal binaries may not be maintained for the full Node.js 26 lifetime. <a href="https://app.daily.dev/posts/xFdfOKFje" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Server-side development, system design, API patterns, and distributed architecture.

Backend Digest

A credential-stealing worm called Miasma backdoored 32 official @redhat-cloud-services npm packages on June 1, 2026, affecting ~117,000 weekly downloads. The attack exploited a compromised Red Hat employee GitHub account, abused OIDC tokens to publish malicious versions with valid SLSA provenance, and self-propagates by stealing tokens to compromise additional packages. Affected users should rotate all CI/CD secrets, cloud credentials, and SSH keys immediately.

Shopify open-sourced GraphQL Cardinal, a breadth-first execution engine that delivers 15x faster field execution, 6x less GC overhead, and 4+ seconds off P50 latency for large list queries while maintaining full schema compatibility.

Apache Kafka 4.3 shipped with 25 KIPs including record header preservation in Streams state stores, Share Group controls, and broker isolation via log directory cordoning. Also covered: an AWS trailing slash bug that bypassed Lambda authorizer authentication entirely, a Palo Alto GlobalProtect VPN auth bypass CVE under active exploitation, Go 1.26 SIMD file scanning benchmarks, GKE standby buffers, Databricks Liquid Clustering benchmarks, and Node.js 26.3.0 release notes.

Red Hat npm supply chain attack hits 32 packages, Shopify open-sources 15x GraphQL speedup