<p><strong>TLDR:</strong> TypeScript 7.0 RC lands with a Go-ported compiler delivering roughly 10x faster builds. GitHub is under pressure from Cursor, GitLab, and Zed, each proposing a different architecture for agent-era code hosting. A critical pre-auth RCE in Oracle PeopleSoft (CVSS 9.8) was exploited in the wild before the patch dropped, and Elastic is acquiring AI SRE startup DeductiveAI for up to $85M. Node.js pushed coordinated security releases across all active lines patching 11 CVEs including a high-severity TLS hostname normalization flaw.</p>
<hr>
<h2>TypeScript 7.0 RC: compiler ported to Go, ~10x faster builds</h2>
<p>The TypeScript compiler has been rewritten in Go, and the RC is out now with a stable release expected within a month. Build times are roughly 10x faster than TypeScript 6.0 thanks to native code speed and shared-memory parallelism. The new compiler is semantically compatible with 6.0’s type-checking but ships with new defaults (strict: true, module: esnext) and turns previously deprecated flags into hard errors. A programmatic API is coming in TypeScript 7.1, and a compatibility package (@typescript/typescript6) lets you run both side by side during migration. The VS Code TypeScript Native Preview extension already includes auto-imports, inlay hints, and semantic highlighting. <a href="https://app.daily.dev/posts/DX1ho4IMo" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Cursor, GitLab, and Zed each propose a different replacement for GitHub</h2>
<p>GitHub is processing 1.4 billion commits per month and logged hundreds of incidents over the past year under AI-generated load. Three companies are now racing to replace it with fundamentally different bets: Cursor’s Origin keeps Git compatibility but adds MCP support and built-in CI failure resolution; GitLab’s Project Switch redesigns the backend to allow server-side repository queries, claiming up to 50x faster agent task execution with 3x fewer tokens; Zed’s DeltaDB is the most radical, ditching Git’s commit model entirely for a continuous stream of fine-grained deltas tied to agent conversations. These aren’t incremental improvements — they reflect genuinely different theories about what the agentic development loop needs from version control. <a href="https://app.daily.dev/posts/kieYdoQVG" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>PeopleSoft pre-auth RCE (CVE-2026-35273, CVSS 9.8) exploited in the wild before patch</h2>
<p>A critical pre-authentication RCE chain in Oracle PeopleSoft PeopleTools 8.61 and 8.62 chains SSRF through the PSIGW Integration Broker gateway into Java XMLDecoder deserialization on web-tier restart. What makes this particularly nasty: execution happens inside the WebLogic JVM with no child process spawned and no outbound beacon, so conventional behavioral and network detection won’t catch it. Oracle issued an out-of-band patch on June 10, but exploitation was already observed from May 27 by threat actor SHADOW-AETHER-015 targeting over 100 organizations. Patch immediately, restrict PSIGW network exposure, and treat web-tier restarts as security-relevant events. <a href="https://app.daily.dev/posts/F19sJr0EU" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Elastic acquires DeductiveAI for up to $85M to add AI SRE to its observability platform</h2>
<p>Elastic is buying DeductiveAI, a three-year-old startup that uses AI agents to automatically detect and resolve software bugs and incidents. The deal is worth up to $85M — notable given DeductiveAI had only reached roughly $1M ARR and raised a $7.5M seed at a $33M valuation just months ago. Elastic plans to fold the technology into its observability platform for automated incident resolution. The acquisition puts Elastic in more direct competition with Resolve AI, which is valued at $1.5 billion in the same space. <a href="https://app.daily.dev/posts/hIGx0eBn8" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Node.js 22, 24, and 26 security releases patch 11 CVEs including high-severity TLS flaw:</strong> All three active Node.js lines (22.23.0 LTS, 24.17.0 LTS, 26.3.1 Current) received coordinated security-only releases patching 11 CVEs, with high-severity fixes for TLS hostname normalization in server identity checks (CVE-2026-48618) and a WebCrypto cipher output length guard (CVE-2026-48933); OpenSSL was updated to 3.5.7 across all lines. <a href="https://app.daily.dev/feed-by-ids?id=HP8Siu0Zv&amp;id=djrgVDQY2&amp;id=8FMsqbwyZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Amazon ECS auto scaling now triggers in 86 seconds instead of 363 using 20-second metrics:</strong> ECS high-resolution metrics (20-second resolution) cut scale-out trigger time from 363 to 86 seconds (76% faster) and total time to provision new tasks from 386 to 109 seconds; enabling it requires activating high-resolution metrics and configuring target tracking policies with the new ECSServiceAverageCPUUtilizationHighResolution metric types, with standard CloudWatch charges applying. <a href="https://app.daily.dev/feed-by-ids?id=ValVfJnMt&amp;id=pZ7Wjjqqm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub actions/checkout v7 blocks ‘pwn request’ attacks by default, enforcement backported July 16:</strong> actions/checkout v7 refuses to fetch fork PR code in pull_request_target and workflow_run workflows when insecure inputs are used; on July 16, 2026, this enforcement is backported to all supported major versions, automatically affecting workflows pinned to floating major tags — review any workflow using pull_request_target before that date. <a href="https://app.daily.dev/posts/cs5C6Qtly" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Klue OAuth breach: ‘Icarus’ group stole Salesforce CRM data via malicious code update:</strong> Attackers compromised Klue’s backend, pushed a malicious update to steal OAuth tokens, then used automated Python scripts to exfiltrate Salesforce CRM data including business contacts, price quotes, and competitive intelligence from multiple organizations; Salesforce has disabled the Klue Battlecards integration and affected organizations should revoke OAuth tokens and audit Salesforce API activity immediately. <a href="https://app.daily.dev/posts/o3rZPffHd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>npm v12 (July 2026) blocks lifecycle scripts, Git deps, and remote URLs by default:</strong> npm v12 will require explicit opt-in via allowScripts, --allow-git, and --allow-remote flags for three vectors involved in ~53% of malicious npm attacks over the past year; new apps are affected immediately, existing apps from July 2026. <a href="https://app.daily.dev/posts/2D4pdCF9o" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Server-side development, system design, API patterns, and distributed architecture.

Backend Digest

TypeScript 7.0 RC is out with a Go-rewritten compiler delivering ~10x faster builds, strict defaults, and a VS Code preview extension. GitHub faces architectural competition from Cursor, GitLab, and Zed, each proposing fundamentally different version control systems for the agentic development era. A critical pre-auth RCE (CVSS 9.8) in Oracle PeopleSoft was exploited in the wild before Oracle's out-of-band patch. Elastic is acquiring AI SRE startup DeductiveAI for up to $85M. Node.js patched 11 CVEs across all active release lines including a high-severity TLS flaw. Also covered: GitHub Actions v7 blocking pwn-request attacks, npm v12 restricting lifecycle scripts by default, and an OAuth breach at Klue exposing Salesforce CRM data.

TypeScript 7.0 RC ships in Go, GitHub rewrites code hosting for agents