<h2>Must know</h2>
<ul>
<li><strong>MongoDB vulnerability exposes sensitive data</strong>: A critical vulnerability, CVE-2025-14847 (MongoBleed), in MongoDB allows unauthenticated attackers to read sensitive data from heap memory due to improper handling of zlib-compressed traffic. All MongoDB versions since 2017 are affected, with security researchers confirming active exploitation and estimating 87,000 servers potentially exposed. While MongoDB Atlas instances are patched, self-hosted deployments require immediate manual updates, as reported by security research disclosures and MongoDB’s advisories. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s ChatGPT health raises privacy concerns</strong>: OpenAI is launching ChatGPT Health in beta, allowing users to integrate medical records for personalized insights, partnering with b.well Connected Health. However, the service is unavailable in the EU/UK due to privacy laws, and critics argue it’s not HIPAA-covered, potentially commoditizing user data for healthcare and insurance companies. This move comes amidst questions about OpenAI’s business model and projected losses, as highlighted by various news and investigative reports. <a href="https://app.daily.dev/feed-by-ids?id=0lod4TIIq&amp;id=FGI4Oyps1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform has critical IDOR vulnerabilities</strong>: Two critical IDOR vulnerabilities, CVE-2026-22589 and CVE-2026-22588, have been discovered in the Spree e-commerce platform. The first allows unauthenticated attackers to access guest user PII, while the second enables authenticated users to access other users’ address data. Patches are available in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5+, with headless API implementations remaining unaffected, according to vulnerability disclosures. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Visual Studio Code adds agent skills for Copilot</strong>: Visual Studio Code 1.108 introduces ‘Agent Skills’ as an experimental feature, allowing developers to extend GitHub Copilot’s capabilities with custom instructions, scripts, and resources organized in <code>.github/skills</code> directories. <a href="https://app.daily.dev/posts/xn90KJxf1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic burns trust with Claude Code restrictions</strong>: Anthropic has restricted Claude Code subscription tokens from third-party tools, forcing users into their official harness, a move seen as anti-competitive by developers, while OpenAI supports Open Code integration with ChatGPT subscriptions. <a href="https://app.daily.dev/posts/PQFa1I0wt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Postman acquires Fern for API documentation</strong>: Postman has acquired Fern, integrating its open-source API documentation and SDK generation tools to enhance developer experience across multiple programming languages. <a href="https://app.daily.dev/feed-by-ids?id=WwNdGJMJK&amp;id=ft8sQFPsm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Drupal 11.3.0 boosts performance and adds HTMX support</strong>: Drupal 11.3.0 delivers a significant performance boost, serving 26-33% more requests, and introduces native HTMX support, reducing JavaScript weight by up to 71% for richer user experiences. <a href="https://app.daily.dev/posts/qoxLrj7Wb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Chromium adds JXL image decoder with Rust</strong>: Chromium now includes a JXL (JPEG XL) image decoder implementation using the <code>jxl-rs</code> Rust library, enabling native JPEG XL image format support in the browser. <a href="https://app.daily.dev/posts/6m8p7Tgqf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Neo4j integrates with Dify for AI workflows</strong>: Neo4j now offers a plugin for Dify, an open-source platform for building AI workflows with LLMs, enabling integration of knowledge graphs into agentic workflows for RAG systems. <a href="https://app.daily.dev/posts/xt2S0tUFX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Tool UI offers open-source components for AI tool calls</strong>: Tool UI is an open-source library providing pre-built, responsive, and accessible UI components specifically designed for AI tool calls, built on Tailwind CSS, Radix UI, and shadcn/ui. <a href="https://app.daily.dev/posts/hox0Alvuh" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI killed Tailwind? Or just its business model?</strong>: Apparently, AI has ‘killed’ Tailwind, leading to 75% staff layoffs and an 80% revenue decline, because AI-generated code bypasses their documentation. The company even rejected GitHub’s request to make their docs more LLM-friendly. So, AI drives adoption but eliminates the monetization path through documentation visits? Sounds like a classic case of ‘innovation’ eating its own tail, or perhaps just a poorly adapted business model. <a href="https://app.daily.dev/posts/f3fYMXuKZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Learning C++ in 2026 is a ‘mistake’</strong>: According to Stefan Mischook, learning C++ in 2026 is a ‘mistake’ due to its ‘diminishing returns’ and ‘manual memory management’ causing bugs. He suggests pivoting to JavaScript, C#, or Java for ‘better productivity.’ Because, you know, modern systems programming, high-performance computing, and game development just don’t exist anymore, and every problem can be solved with a garbage collector and a web framework. Sure, Jan. <a href="https://app.daily.dev/posts/trj7gVKm4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flock Safety hardcodes passwords for America’s surveillance infrastructure</strong>: A security researcher found Flock Safety hardcoded their ArcGIS API key across 53 public JavaScript bundles, granting unrestricted access to mapping infrastructure containing surveillance data from 12,000 law enforcement and private deployments. This exposed private data layers like license plate detections and patrol car locations. They fixed it, but another critical vulnerability remains unpatched. It’s almost like ‘security through obscurity’ isn’t a robust strategy for ‘America’s surveillance infrastructure.’ Who would’ve thought? <a href="https://app.daily.dev/posts/rFxdWrNGg" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
