daily.dev

Where developers discover what's next

[daily.dev @dailydotdev]

Introducing Marketplace!

Plugins for you and your agent, built by developers for developers:
→ apps built on our Public API
→ SKILL.md files your agent can run via our MCP server

Find awesome plugins, or ship your own from the web, the API, or straight from your agent.

https://t.co/wFBzRThZv0

[daily.dev @dailydotdev]

RT @idoshamun: 23 CVEs!!

Unless you live under a rock, you may have heard of all the vulnerabilities found in the last 24h.

Give this to…

[daily.dev @dailydotdev]

Anthropic wants Claude to come to you before you ask.

[daily.dev @dailydotdev]

Railway is telling every customer to rotate every secret.

[daily.dev @dailydotdev]

In 2019, about 1% of Hacker News "Who is hiring?" posts asked for a product engineer. By mid-October 2026 it was 9.5%. Linear's CTO says engineers will have to become "mini PMs" who talk with customers.

From episode 3 of Off the Leash, daily dev's podcast for when the headline isn't enough. The full episode is on YouTube, Spotify and Apple Podcasts.

[daily.dev @dailydotdev]

GitHub wants to stop package malware before it ever runs.

[Ido Shamun @idoshamun]

grinding works

building a b2c product means failing every day but once in a while you get a breakthrough, and when it happens it's freaking magical.

for weeks we've been trying to increase the number of shares on the platform. playing around with placements, sizes, options, and so many things with no sucess.

but when we launched the snapshot feature, it finally clicked and number of shares spiked by x2.5!

[daily.dev @dailydotdev]

Is everyone a product engineer now?

@satyanadella says LinkedIn combined four roles and said they're all "full stack builders." Claude Code's creator, @bcherny, thinks we'll start to see the title software engineer go away. On the new Off the Leash, daily dev's podcast, we check that against our own count of every Hacker News "Who is hiring?" post since 2019, and go back to 1974, when the US government saw programmers and systems analysts starting to merge into one job.

Then we get to the second role Nadella named in the same answer, who's still hiring juniors, and what to learn now.

[daily.dev @dailydotdev]

NetScaler zero-days exploited before patches existed

[daily.dev @dailydotdev]

Microsoft is no longer just reselling OpenAI's models.

[daily.dev @dailydotdev]

China now wants to control which AI leaves its borders.

[daily.dev @dailydotdev]

Companies pushed AI with leaderboards, tokenmaxxing and AI use in performance reviews. Then Duolingo took AI use out of its reviews, Amazon shut down KiroRank and Shopify renamed its leaderboard. Even if your company counts tokens, it's still your name on what you send.

From episode 2 of Off the Leash, daily dev's podcast for when the headline isn't enough. The full episode is on YouTube, Spotify and Apple Podcasts.

[daily.dev @dailydotdev]

Attackers skipped MFA by signing in as a backup app

[daily.dev @dailydotdev]

One stolen credential was enough to raid Meta's GitHub

[daily.dev @dailydotdev]

Who are the most hated people in tech right now? The ones who forward AI output from one chat to another, on Slack, WhatsApp and GitHub, without reading it. They're called meat proxies.

From episode 2 of Off the Leash, daily dev's podcast for when the headline isn't enough. The full episode is on YouTube, Spotify and Apple Podcasts.

[daily.dev @dailydotdev]

BeyondTrust zero-day: Chinese spies lived inside for a month

[daily.dev @dailydotdev]

Modal's AI agent code execution is a $300M business

[daily.dev @dailydotdev]

You ask why they made that call in their PR, and it turns out Claude decided. "If I wanted to talk to Claude, I would do it myself."

From episode 2 of Off the Leash, daily dev's podcast for when the headline isn't enough. The full episode is on YouTube, Spotify and Apple Podcasts.

[daily.dev @dailydotdev]

npm's Trusted Publishing left 1,500 packages open to hijack

[daily.dev @dailydotdev]

OpenAI is breaking its own six-month deprecation promise

[daily.dev @dailydotdev]

Someone filed an AI-written crash report on Ghostty. A commenter called it unhelpful and overly verbose, so they replied with more of the same. The maintainer told them to "stop being a g*ddamn meat proxy and use your own language skills," and banned them from contributing.

From episode 2 of Off the Leash, daily dev's podcast for when the headline isn't enough. The full episode is on YouTube, Spotify and Apple Podcasts.