<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/tags/golang/best-of/2026/07" -->

---
title: Best Golang posts — July 2026 | daily.dev
description: The most upvoted Golang posts from July 2026, curated by the daily.dev community.
canonical: https://daily.dev/tags/golang/best-of/2026/07
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:url: https://daily.dev/tags/golang/best-of/2026/07
og:type: website
og:site_name: daily.dev
og:title: Best Golang posts — July 2026 | daily.dev
og:description: The most upvoted Golang posts from July 2026, curated by the daily.dev community.
og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph
---

# Best of Golang — July 2026

1. 1  
[](https://daily.dev/posts/go-1-26-quietly-fixed-the-things-that-were-actually-annoying-eei6x0bgf "Go 1.26 Quietly Fixed the Things That Were Actually Annoying")  
Article  
![Avatar of towardsdev](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/2c710db2750a4a70835862534cb7c9d4)Towards Dev · 11w  
Go 1.26 Quietly Fixed the Things That Were Actually Annoying  
Go 1.26 focuses on practical improvements over flashy features. The headline change is Green Tea GC becoming the default, promising 10–40% reduction in GC overhead for production services with no code changes required. Other notable additions include: \`new()\` accepting expressions for cleaner pointer-to-optional-value patterns, a rewritten \`go fix\` tool with automated modernizers and a source-level inliner for library migration paths, faster cgo calls, heap base address randomization for security hardening, an experimental goroutine leak profiler, and three new standard library packages (crypto/hpke, simd/archsimd, runtime/secret). The post also notes removal of \`cmd/doc\`/\`go tool doc\` in favor of \`go doc\`, and pprof defaulting to flame graphs.  
106
2. 2  
[](https://daily.dev/posts/write-pdfs-in-react-render-them-from-go-no-node-no-browser-no-sidecar--yoq6vdfyj "Write PDFs in React. Render them from Go. No Node, no browser, no sidecar.")  
Article  
![Avatar of medium_js](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium)Medium · 9w  
Write PDFs in React. Render them from Go. No Node, no browser, no sidecar.  
A developer built 'waffle', an open-source library that lets you author PDF documents using React 18 components and render them entirely inside a Go binary — no Node.js, no headless Chromium, no sidecar process. It uses esbuild (pure Go) to compile JSX in memory and goja (a JS engine written in Go) to execute real React. The element tree produced by React is serialized as JSON, then a Go pipeline handles flexbox layout, pagination, and PDF writing. A warm 1-page render takes \~6.6ms serially; an 8-page document with fonts uses \~83 MiB peak vs. hundreds of MB for a browser-based approach. Trade-offs include no arbitrary HTML/CSS, synchronous-only rendering, and a per-template asset cache.  
91  
2
3. 3  
[](https://daily.dev/posts/go-flavored-concurrency-in-c-pn7rvhkwd "Go-flavored concurrency in C")  
Article  
![Avatar of antonz](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/29aa129ca24545f1a698d8a206ccc372)Anton Zhiyanov · 10w  
Go-flavored concurrency in C  
A deep dive into implementing Go-style concurrency primitives in C using POSIX threads, as part of the Solod project — a Go-to-C transpiler. Covers mutex/cond wrappers, atomics, worker pools, and buffered/unbuffered channels, with detailed benchmark comparisons against Go. Key finding: pthread-based concurrency matches Go within \~10% for coarse-grained pooled workloads, but is 7-23x slower for fine-grained blocking operations due to kernel wakeup costs vs. Go's userspace scheduler. Design decisions include choosing pthreads over fiber libraries for simplicity, keeping concurrency in the stdlib rather than the language, and using timeouts instead of implementing select.  
66  
5
4. 4  
[](https://daily.dev/posts/github---hasenj-go-shirei-go-based-gui-framework-practical-immediate-mode-flexbox-model-38svrxbdl "GitHub - hasenj/go-shirei: Go based GUI framework: practical, immediate mode, flexbox model")  
Article  
![Avatar of hn](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn)Hacker News · 10w  
GitHub - hasenj/go-shirei: Go based GUI framework: practical, immediate mode, flexbox model  
Shirei is a cross-platform, immediate mode GUI framework for Go that lets developers build native desktop applications without HTML or JavaScript. It produces identical-looking programs for macOS, Windows, and Linux with a typical binary size of \~10MB and no external dependencies. The framework features a true immediate mode API (no widget state management), full international text support including bidirectional layout and IME, flexbox-inspired flexible layouts, and a simple getting-started experience with minimal boilerplate. The API is designed to be easy for both humans and AI agents to use.  
63  
4
5. 5  
[](https://daily.dev/posts/5-dockerfile-best-practices-that-are-actually-wrong-nna4rndi5 "5 Dockerfile “Best Practices” That Are Actually Wrong")  
Video  
![Avatar of devopstoolbox](https://media.daily.dev/image/upload/s--zlfrGvN5--/f_auto/v1752671176/logos/devopstoolbox)DevOps Toolbox · 9w  
5 Dockerfile “Best Practices” That Are Actually Wrong  
Five common Dockerfile misconceptions are debunked with practical demos. First, Alpine images use musl libc instead of glibc, causing compatibility failures with many native packages — Slim is usually the better tradeoff. Second, Docker layer caching is frequently abused by copying source code before installing dependencies, forcing full reinstalls on every code change. Third, sending unnecessary files into the build context (node\_modules, logs, artifacts) bloats builds — .dockerignore solves this cleanly. Fourth, multi-stage builds for compiled languages like Go can shrink images from 272MB down to 2.3MB using scratch or distroless base images. Fifth, the 'one process per container' rule is a guideline, not a law — supervisord is a practical solution when running nginx alongside an app server without Kubernetes overhead. A bonus tip covers pinning images by digest hash rather than mutable tags to prevent unexpected base image changes. The Rust tool 'd-roast' is mentioned for linting Dockerfiles in local and CI environments.  
54
6. 6  
[](https://daily.dev/posts/why-we-chose-rust-over-go-for-our-new-caching-layer-mnzbcrfmj "Why We Chose Rust over Go for Our New Caching Layer")  
Article  
![Avatar of medium_js](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium)Medium · 8w  
Why We Chose Rust over Go for Our New Caching Layer  
A team that previously migrated from Node.js to Go found Go's garbage collector caused P99 latency spikes of 50–100ms in a high-throughput in-memory caching layer processing millions of requests per second. They rewrote the cache in Rust using DashMap, eliminating GC pauses entirely. Results: P99 latency dropped from 50ms to 1.5ms, memory usage fell 70%, and CPU usage halved. The conclusion is that Go remains the default for standard microservices, but Rust is the right tool for extreme, latency-sensitive workloads.  
47  
6
7. 7  
[](https://daily.dev/posts/networking-taught-the-way-it-should-be-then-built-in-go-zdu4dlqxz "Networking, taught the way it should be — then built in Go")  
Article  
![Avatar of eexhvzfp824uaxinoymgz](https://media.daily.dev/image/upload/s--znH0-blf--/f_auto/v1777393282/avatars/avatar_eexHvzfP824UAxinOYMGz?_a=BAMAMiWQ0)Kashitsuwa · 10w  
Networking, taught the way it should be — then built in Go  
A free, hands-on book covering computer networking fundamentals and network programming in Go. It targets three audiences simultaneously: networking beginners, Go beginners, and experienced developers seeking a deep reference. The book progresses from theory (with story-driven explanations and historical context) through complete, runnable Go programs, all the way to building production-grade APIs and performing offensive/defensive security work.  
46  
11
8. 8  
[](https://daily.dev/posts/solod-0-3-concurrency-json-more-safety-tzbhcshnw "Solod 0.3: Concurrency, JSON, more safety")  
Article  
![Avatar of antonz](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/29aa129ca24545f1a698d8a206ccc372)Anton Zhiyanov · 8w  
Solod 0.3: Concurrency, JSON, more safety  
Solod 0.3 is a new release of Solod (So), a strict subset of Go that transpiles to plain C with no runtime and manual memory management. This version adds OS thread support via a \`conc\` package (threads, channels, worker pools), mutex and atomic primitives via \`sync\` and \`sync/atomic\`, a streaming token-level JSON encoder/decoder, and several safety features including escape analysis, leak detection via \`mem.Tracker\`, nil-pointer panics with stack traces, and C sanitizer integration. Tooling improvements include \`so test\`, \`so bench\`, fuzzing support via Go's built-in fuzzer, and automatic C library linking via a \`so:link\` directive.  
40  
5
9. 9  
[](https://daily.dev/posts/the-great-go-transaction-dilemma-clean-architecture-vs-idiomatic-go-sycdikyh5 "The Great Go Transaction Dilemma: Clean Architecture vs. Idiomatic Go")  
Article  
![Avatar of medium_js](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium)Medium · 8w  
The Great Go Transaction Dilemma: Clean Architecture vs. Idiomatic Go  
When building a Go backend with Clean Architecture, passing database transactions from the Service layer to the Repository layer creates a design tension. Two patterns are compared: the Explicit Parameter pattern (passing \*gorm.DB directly, idiomatic but leaks infrastructure into domain logic) and the Context-Injection pattern (storing the transaction in context.Context, clean architecture-friendly but implicit). The author chose Context-Injection, arguing that transactions are inherently request-scoped and map naturally to context lifecycle. Guardrails include unexported context keys and a GetDB helper that gracefully falls back to the default DB pool when no transaction is present.  
30
10. 10  
[](https://daily.dev/posts/supercharge-your-php-apps-with-go-powered-php-extensions-u4lfzmc0u "Supercharge your PHP apps with Go-powered PHP extensions")  
Article  
![Avatar of freek](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/286e833d1aaa453d99849cd4dbb7a106)FREEK.DEV · 9w  
Supercharge your PHP apps with Go-powered PHP extensions  
A conference session covering how to build PHP extensions using Go and FrankenPHP, then integrate them into Laravel and Symfony as native-feeling features. An in-memory LRU cache serves as the practical example, providing a tour of PHP internals and framework flexibility.  
28  
1
11. 11  
[](https://daily.dev/posts/announcing-v1-of-opentelemetry-go-compile-time-instrumentation-sf7b5uncy "Announcing v1 of OpenTelemetry Go Compile-Time Instrumentation")  
Article  
![Avatar of opentelemetry](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/058cf331ff204b6aa421b376d509f16e)OpenTelemetry · 10w  
Announcing v1 of OpenTelemetry Go Compile-Time Instrumentation  
OpenTelemetry has released v1 of its Go Compile-Time Instrumentation, closing a long-standing gap where Go developers had to instrument code manually or use eBPF agents. The tool, \`otelc\`, hooks into the Go toolchain via \`-toolexec\` and injects OpenTelemetry traces and metrics at build time — no source code changes required. It covers third-party libraries and the standard library, supports \`net/http\`, \`database/sql\`, gRPC, Redis, and Go runtime metrics, and is CI/CD friendly. A single build command swap (\`otelc go build\` instead of \`go build\`) is all that's needed. The project was built collaboratively by Alibaba and Datadog under the OpenTelemetry SIG. Future plans include broader library coverage, registry-based discovery, and performance improvements.  
25  
1
12. 12  
[](https://daily.dev/posts/theprimeagen-tries-to-focus-vpuqs1xp7 "ThePrimeagen tries to focus")  
Video  
![Avatar of tom_delalande](https://media.daily.dev/image/upload/s--yepApVPv--/f_auto,q_auto/v1782139213/logos/tom_delalande)Tom Delalande · 11w  
ThePrimeagen tries to focus  
A chaotic, stream-of-consciousness video transcript from ThePrimeagen in which he repeatedly starts and abandons project ideas — a Go web server, a Neovim plugin in Lua, a Vim game in Rust, a tower defense game in Zig, and an MMO in Odin/Jai — while going on extended tangents about personal stories, JavaScript criticism, beer, and chat engagement tactics. Very little actual coding happens.  
24  
7
13. 13  
[](https://daily.dev/posts/why-i-always-specify-types-for-constants-in-go-and-name-the-unit-too--c6a7b5ubi "Why I Always Specify Types for Constants in Go (And Name the Unit Too)")  
Article  
![Avatar of medium_js](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium)Medium · 9w  
Why I Always Specify Types for Constants in Go (And Name the Unit Too)  
Go's untyped constants are flexible but can silently introduce bugs when passed to named types like time.Duration. A bare constant like \`const JobTimeout = 5\` passed to a time.Duration parameter becomes 5 nanoseconds instead of 5 minutes, compiles without error, and only fails under production load. The fix involves two practices: explicitly typing constants with their intended named type (e.g., \`const JobTimeout time.Duration = 5 \* time.Minute\`) and encoding the unit in the constant name (e.g., JobTimeoutMinutes). The same discipline applies to byte sizes, custom named types, and iota-based enumerations — typed iota constants prevent accidental mixing of semantically distinct integer enumerations. The broader principle: when a constant crosses a semantic boundary into a named type, make the semantics explicit in both the type annotation and the name.  
23
14. 14  
[](https://daily.dev/posts/goland-2026-2-is-now-available--t1h8gdeor "GoLand 2026.2 Is Now Available!")  
Article  
![Avatar of jetbrains](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/53ecf0c676f34b3896ee109609d91efa)JetBrains · 10w  
GoLand 2026.2 Is Now Available!  
GoLand 2026.2 introduces a new Go Optimization tool window that consolidates profiling, escape analysis, and struct optimization into a single workflow. Key highlights include pprof profiling for regular Go applications without extra setup, support for Go 1.27's new Goroutine leak profile, a redesigned profile viewer with flame graphs and call trees, live CPU/memory charts, and escape analysis visualization in the editor. The release also integrates the official \`go fix\` tool for code modernization, adds Docker Compose inline actions and service templates, Terraform testing framework support, and expands AI capabilities with configurable completion models and GitHub Copilot integration. IDE performance improvements include async file saves, faster code analysis for large projects, and better Git worktree support.  
21  
3
15. 15  
[](https://daily.dev/posts/benchmark-profile-prove-a-12x-go-performance-win-an35pmwsr "Benchmark, Profile, Prove: A 12x Go Performance Win")  
Article  
![Avatar of itnext](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/itnext2)ITNEXT · 8w  
Benchmark, Profile, Prove: A 12x Go Performance Win  
A Go developer investigates performance of a Grafana Kafka datasource plugin using a benchmark-profile-fix-prove loop. Using pprof and benchstat, they discover that Avro and Protobuf schemas were being recompiled on every message — not byte decoding as assumed. Caching schemas with a bounded LRU yields a 4.3x improvement for Avro and 12.5x for Protobuf. Two additional fixes — caching sorted field order and micro-batching frames — further reduce redundant work and network overhead. The post details exact pprof commands, benchstat usage for statistical validation, and a feature-flag pattern for toggling fixes without rebuilding.  
28  
2
16. 16  
[](https://daily.dev/posts/go-htmx-sqlite-the-ultimate-stack-for-the-ai-era-ceghar1od "Go + HTMX + SQLite: The Ultimate Stack for the AI Era")  
Video  
![Avatar of youtube](https://media.daily.dev/image/upload/s--W5zMumpP--/f_auto/v1725350181/logos/youtube)YouTube · 8w  
Go + HTMX + SQLite: The Ultimate Stack for the AI Era  
Go, HTMX, and SQLite are argued to be the ideal stack for the AI coding era because each technology minimizes translation layers that cause AI-generated code to fail. HTMX lets AI output HTML directly without JSX or build steps. Go's opinionated simplicity and strict compiler catch AI mistakes at build time, and its single-binary deployment eliminates environment complexity. SQLite removes the entire database server tier, enabling sub-millisecond reads, trivial multi-tenant isolation, and even vector search for RAG apps — all in one file. The argument is that a smaller, simpler stack means an AI agent can hold the entire codebase in context and generate correct code on the first try. Honest caveats are included: SQLite's single-writer limit and HTMX's unsuitability for deeply stateful client-side apps like Figma.  
19  
6
17. 17  
[](https://daily.dev/posts/github---robertsdotpm-runloom-real-goroutines-for-python-3-13t-free-threaded--83sjt8qk7 "GitHub - robertsdotpm/runloom: Real Goroutines for Python 3.13t+ free-threaded.")  
Article  
![Avatar of hn](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn)Hacker News · 10w  
GitHub - robertsdotpm/runloom: Real Goroutines for Python 3.13t+ free-threaded.  
Runloom is a Python library that brings Go-style stackful coroutines (goroutines) to Python 3.13t+ with the GIL disabled. It uses a hand-rolled assembly context switch, a C-based M:N work-stealing scheduler, and netpoll to let developers write plain blocking code that runs concurrently across all CPU cores. Benchmarks show it matches Go's spawn rate (2.29M/s vs 2.10M/s in pure C) and achieves near-parity on throughput (596k vs 603k req/s). The main trade-off is memory: a suspended fiber uses \~3.3× more RAM than a Go goroutine due to CPython's eval frame. A monkey-patch API makes existing blocking stdlib code cooperative without rewrites, and an asyncio bridge provides a migration path from async/await code.  
19
18. 18  
[](https://daily.dev/posts/model-driven-software-architecture-one-schema-to-rule-your-database-apis-and-code-vcm8vcr4t "Model-Driven Software Architecture: One Schema to Rule Your Database, APIs, and Code")  
Article  
![Avatar of medium_js](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium)Medium · 8w  
Model-Driven Software Architecture: One Schema to Rule Your Database, APIs, and Code  
A model-driven software architecture approach using YANG as a single source of truth to automatically generate Go structs, database migrations, and REST API specs. The pipeline uses YANG custom extensions to embed GORM index tags, Atlas to diff schemas and produce Liquibase changesets, and OpenAPI codegen to scaffold HTTP handlers and client SDKs. A single field addition in YANG cascades through the entire stack: Go struct, DB migration, OpenAPI spec, Swagger docs, and client libraries — all without manual translation.  
20  
1
19. 19  
[](https://daily.dev/posts/blog-timezone-is-an-architecture-decision-the-case-for-go-development-in-colombia-u4wq8eqkr "Blog: Timezone Is an Architecture Decision: The Case for Go Development in Colombia")  
Article  
![Avatar of wawandco](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/6fd59b4ffa57474a8d77c28a4d7deadb)Wawandco · 11w  
Blog: Timezone Is an Architecture Decision: The Case for Go Development in Colombia  
Timezone overlap is framed as a core engineering decision rather than an administrative detail. Research shows each hour of time difference reduces synchronous communication by 11%, meaning 8-12 hour gaps with offshore teams structurally eliminate real-time collaboration. Colombia's one-hour offset from US Eastern Time enables live standups, real-time incident response, and architecture conversations during shared working hours. Go-specific failure modes like goroutine leaks, concurrency bugs, and silent error propagation are harder to catch in async review across large timezone gaps. Colombian senior Go developers earn roughly 2.7x less than US counterparts, and the country's 150,000+ IT professional pool and growing cloud-native ecosystem make it a compelling nearshore option compared to Argentina, Brazil, or Mexico.  
18  
2
20. 20  
[](https://daily.dev/posts/earn-the-line-uabmz3qdw "Earn the line")  
Video  
![Avatar of primeagen](https://media.daily.dev/image/upload/s--J5-GjDeo--/f_auto/v1704628081/logos/primeagen.jpg)ThePrimeTime · 9w  
Earn the line  
A humorous, informal video transcript where developers banter while building a web server in Go that connects to a database. The content is light-hearted and comedic, with the main technical premise being a Go web server project.  
17
21. 21  
[](https://daily.dev/posts/the-attr-type-udhsolgm5 "The Attr type")  
Article  
![Avatar of boldlygo](https://media.daily.dev/image/upload/s--0HXlQZhy--/f_auto,q_auto/v1780213594/logos/boldlygo?_a=BAMAMiWQ0)Boldly Go · 12w  
The Attr type  
A focused look at the slog.Attr type in Go's standard library slog package. Covers the Attr struct (a key-value pair), the general-purpose Any constructor, and briefly introduces type-specific constructors like Bool, Duration, and Float64\. Explains that Any works for all types but type-specific constructors avoid runtime type assertions.  
19
22. 22  
[](https://daily.dev/posts/how-openai-delivers-low-latency-voice-ai-for-900m-users-dyatzvnes "How OpenAI Delivers Low-Latency Voice AI for 900M Users")  
Article  
![Avatar of bytebytego](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/35be29234ee14d01a9cd049c52e12753)ByteByteGo · 12w  
How OpenAI Delivers Low-Latency Voice AI for 900M Users  
OpenAI serves voice AI to 900 million weekly users by splitting WebRTC infrastructure into two components: a stateless relay for packet routing at the geographic edge and a stateful transceiver that owns ICE, DTLS, and SRTP state. The key routing trick encodes destination metadata into the ICE ufrag field, allowing the relay to forward the first packet to the correct transceiver without a database lookup. The relay is implemented in Go using SO\_REUSEPORT, thread pinning via runtime.LockOSThread, and pre-allocated buffers — avoiding kernel bypass entirely. Global Relay distributes ingress points geographically, with Cloudflare handling proximity-based signaling steering. The post also covers why SFU and TURN were evaluated and rejected for this predominantly 1:1 workload, and discusses tradeoffs including limited multiparty support and a custom infrastructure maintenance burden.  
18  
2
23. 23  
[](https://daily.dev/posts/slog-groupattrs-cmhm9xwg4 "slog.GroupAttrs")  
Article  
![Avatar of boldlygo](https://media.daily.dev/image/upload/s--0HXlQZhy--/f_auto,q_auto/v1780213594/logos/boldlygo?_a=BAMAMiWQ0)Boldly Go · 10w  
slog.GroupAttrs  
Covers the difference between slog.Group and slog.GroupAttrs in Go's structured logging package, noting that GroupAttrs is more efficient but only accepts slog.Attr values with no mixed form. Provides a practical toAttrs helper function that replicates slog's internal logic for converting variadic any arguments (including both string key/value pairs and slog.Attr values) into a \[\]slog.Attr slice, useful when building custom slog wrapper utilities.  
16  
2
24. 24  
[](https://daily.dev/posts/witr-why-is-this-running-trace-process-port-container-or-file-kveuzlpib "witr: Why is this running? Trace process, port, container or file")  
Article  
![Avatar of ph](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ph)Product Hunt · 8w  
witr: Why is this running? Trace process, port, container or file  
witr is a static Go binary CLI tool that answers 'why is this running?' for processes, ports, containers, and files. Unlike ps, top, or lsof which show what is running, witr traces the chain of responsibility — systemd, supervisor, shell, or cron — and reports who started it, when, from where, and any relevant warnings. It offers an interactive TUI with tabs for Processes, Ports, Containers, and Locks, as well as scripting modes via --short for a one-line chain summary and --json with exit codes. Available for Linux, macOS, Windows, and BSD as a single static binary.  
201  
8
25. 25  
[](https://daily.dev/posts/goserpent-backdoor-attacks-in-southeast-asia-s7okvghei "GoSerpent backdoor attacks in Southeast Asia")  
Article  
![Avatar of securelist](https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07)Securelist · 10w  
GoSerpent backdoor attacks in Southeast Asia  
Kaspersky researchers detail a sophisticated two-phase cyberattack campaign targeting government and diplomatic entities in Southeast Asia, active since late 2025\. The primary tool is GoSerpent, a Go-based backdoor with SOCKS5 proxy, file transfer, and remote shell capabilities, using AES-CBC and ChaCha20 encryption for C2 communications. In the initial phase, GoSerpent deploys ThumbcacheService (a DLL that silently collects and archives Office/PDF documents), Mimikatz, and QuarksDumpLocalHash for credential theft. In May 2026, attackers returned with Stowaway (an open-source-based proxy RAT) and TmcLoader/TmcPayload, a C++ loader that injects into svchost to exfiltrate the previously collected data via network shares using stolen credentials. The toolchain is tightly integrated: ThumbcacheService stores files in a specific database, and TmcPayload is hardcoded to exfiltrate that exact file. Infrastructure relies on Alibaba Cloud and UCLOUD HK. Attribution tentatively points to TetrisPhantom. IoCs including file hashes and C2 IPs are provided.  
13  
1

[See all Golang archives](/tags/golang/best-of)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/tags/golang/best-of/2026/07#page","url":"https://daily.dev/tags/golang/best-of/2026/07","name":"Best Golang Posts — July 2026","description":"The most upvoted Golang posts from July 2026, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/tags/golang/best-of/2026/07#items","numberOfItems":25,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/go-1-26-quietly-fixed-the-things-that-were-actually-annoying-eei6x0bgf","name":"Go 1.26 Quietly Fixed the Things That Were Actually Annoying"},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/write-pdfs-in-react-render-them-from-go-no-node-no-browser-no-sidecar--yoq6vdfyj","name":"Write PDFs in React. Render them from Go. No Node, no browser, no sidecar."},{"@type":"ListItem","position":3,"url":"https://daily.dev/posts/go-flavored-concurrency-in-c-pn7rvhkwd","name":"Go-flavored concurrency in C"},{"@type":"ListItem","position":4,"url":"https://daily.dev/posts/github---hasenj-go-shirei-go-based-gui-framework-practical-immediate-mode-flexbox-model-38svrxbdl","name":"GitHub - hasenj/go-shirei: Go based GUI framework: practical, immediate mode, flexbox model"},{"@type":"ListItem","position":5,"url":"https://daily.dev/posts/5-dockerfile-best-practices-that-are-actually-wrong-nna4rndi5","name":"5 Dockerfile “Best Practices” That Are Actually Wrong"},{"@type":"ListItem","position":6,"url":"https://daily.dev/posts/why-we-chose-rust-over-go-for-our-new-caching-layer-mnzbcrfmj","name":"Why We Chose Rust over Go for Our New Caching Layer"},{"@type":"ListItem","position":7,"url":"https://daily.dev/posts/networking-taught-the-way-it-should-be-then-built-in-go-zdu4dlqxz","name":"Networking, taught the way it should be — then built in Go"},{"@type":"ListItem","position":8,"url":"https://daily.dev/posts/solod-0-3-concurrency-json-more-safety-tzbhcshnw","name":"Solod 0.3: Concurrency, JSON, more safety"},{"@type":"ListItem","position":9,"url":"https://daily.dev/posts/the-great-go-transaction-dilemma-clean-architecture-vs-idiomatic-go-sycdikyh5","name":"The Great Go Transaction Dilemma: Clean Architecture vs. Idiomatic Go"},{"@type":"ListItem","position":10,"url":"https://daily.dev/posts/supercharge-your-php-apps-with-go-powered-php-extensions-u4lfzmc0u","name":"Supercharge your PHP apps with Go-powered PHP extensions"},{"@type":"ListItem","position":11,"url":"https://daily.dev/posts/announcing-v1-of-opentelemetry-go-compile-time-instrumentation-sf7b5uncy","name":"Announcing v1 of OpenTelemetry Go Compile-Time Instrumentation"},{"@type":"ListItem","position":12,"url":"https://daily.dev/posts/theprimeagen-tries-to-focus-vpuqs1xp7","name":"ThePrimeagen tries to focus"},{"@type":"ListItem","position":13,"url":"https://daily.dev/posts/why-i-always-specify-types-for-constants-in-go-and-name-the-unit-too--c6a7b5ubi","name":"Why I Always Specify Types for Constants in Go (And Name the Unit Too)"},{"@type":"ListItem","position":14,"url":"https://daily.dev/posts/goland-2026-2-is-now-available--t1h8gdeor","name":"GoLand 2026.2 Is Now Available!"},{"@type":"ListItem","position":15,"url":"https://daily.dev/posts/benchmark-profile-prove-a-12x-go-performance-win-an35pmwsr","name":"Benchmark, Profile, Prove: A 12x Go Performance Win"},{"@type":"ListItem","position":16,"url":"https://daily.dev/posts/go-htmx-sqlite-the-ultimate-stack-for-the-ai-era-ceghar1od","name":"Go + HTMX + SQLite: The Ultimate Stack for the AI Era"},{"@type":"ListItem","position":17,"url":"https://daily.dev/posts/github---robertsdotpm-runloom-real-goroutines-for-python-3-13t-free-threaded--83sjt8qk7","name":"GitHub - robertsdotpm/runloom: Real Goroutines for Python 3.13t+ free-threaded."},{"@type":"ListItem","position":18,"url":"https://daily.dev/posts/model-driven-software-architecture-one-schema-to-rule-your-database-apis-and-code-vcm8vcr4t","name":"Model-Driven Software Architecture: One Schema to Rule Your Database, APIs, and Code"},{"@type":"ListItem","position":19,"url":"https://daily.dev/posts/blog-timezone-is-an-architecture-decision-the-case-for-go-development-in-colombia-u4wq8eqkr","name":"Blog: Timezone Is an Architecture Decision: The Case for Go Development in Colombia"},{"@type":"ListItem","position":20,"url":"https://daily.dev/posts/earn-the-line-uabmz3qdw","name":"Earn the line"},{"@type":"ListItem","position":21,"url":"https://daily.dev/posts/the-attr-type-udhsolgm5","name":"The Attr type"},{"@type":"ListItem","position":22,"url":"https://daily.dev/posts/how-openai-delivers-low-latency-voice-ai-for-900m-users-dyatzvnes","name":"How OpenAI Delivers Low-Latency Voice AI for 900M Users"},{"@type":"ListItem","position":23,"url":"https://daily.dev/posts/slog-groupattrs-cmhm9xwg4","name":"slog.GroupAttrs"},{"@type":"ListItem","position":24,"url":"https://daily.dev/posts/witr-why-is-this-running-trace-process-port-container-or-file-kveuzlpib","name":"witr: Why is this running? Trace process, port, container or file"},{"@type":"ListItem","position":25,"url":"https://daily.dev/posts/goserpent-backdoor-attacks-in-southeast-asia-s7okvghei","name":"GoSerpent backdoor attacks in Southeast Asia"}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Tags","item":"https://daily.dev/tags"},{"@type":"ListItem","position":3,"name":"Golang","item":"https://daily.dev/tags/golang"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/tags/golang/best-of"},{"@type":"ListItem","position":5,"name":"July 2026"}]}]}
```

