<h2>Must know</h2>
<ul>
<li><strong>MongoDB vulnerability exposes sensitive data</strong>: A critical vulnerability, CVE-2025-14847 (MongoBleed), in MongoDB allows unauthenticated remote attackers to read sensitive data from heap memory due to improper handling of zlib-compressed network traffic. All MongoDB versions since 2017 are affected, with active exploitation reported and an estimated 87,000 servers potentially exposed. While MongoDB Atlas instances are patched, self-hosted deployments require immediate manual updates, as highlighted by security researchers. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s ChatGPT health raises privacy concerns</strong>: OpenAI has launched ChatGPT Health in beta, allowing users to integrate medical records for personalized insights, partnering with b.well Connected Health. However, the service is unavailable in the EU/UK due to privacy laws and is likely not HIPAA-covered, raising significant concerns about user data commoditization. Financial analyses question OpenAI’s business model, suggesting aggressive monetization of user data to offset projected losses, as reported by various news outlets. <a href="https://app.daily.dev/feed-by-ids?id=0lod4TIIq&amp;id=FGI4Oyps1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform hit by critical IDOR vulnerabilities</strong>: Two critical IDOR (Insecure Direct Object Reference) vulnerabilities, CVE-2026-22589 and CVE-2026-22588, have been discovered in the Spree e-commerce platform. These flaws allow attackers to access guest and authenticated user PII, including names and addresses, by manipulating object identifiers. Patches are available in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5+, and immediate updates are recommended for affected deployments, according to vulnerability disclosures. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI agents shift debugging to traces, not code</strong>: For AI agents, the true source of truth for debugging and understanding behavior moves from the code to runtime traces, as decision logic resides within the LLM, making trace analysis crucial for observability and collaboration. <a href="https://app.daily.dev/posts/4345MlXhv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Visual Studio Code introduces agent skills for Copilot</strong>: Visual Studio Code 1.108 includes an experimental ‘Agent Skills’ feature, allowing developers to extend GitHub Copilot’s capabilities by providing custom instructions, scripts, and resources in designated skill folders. <a href="https://app.daily.dev/posts/xn90KJxf1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Neo4j integrates with Dify for LLM workflows</strong>: Neo4j now offers a plugin for Dify, an open-source platform for building AI workflows, enabling the integration of knowledge graphs into agentic systems through Cypher queries and RAG systems. <a href="https://app.daily.dev/posts/xt2S0tUFX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fontys ICT builds institutional AI platform with gateway architecture</strong>: Fontys ICT, a Dutch university, implemented a governed multi-provider AI platform using a gateway architecture to provide controlled access to AI tools while ensuring compliance and cost management. <a href="https://app.daily.dev/posts/GzyPXVfmC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open source ecosystem sees acquisitions and security updates</strong>: Postman acquired Fern to enhance API documentation, React Router disclosed six security vulnerabilities, and Google established a Bluesky presence for open source contributions, while debates continue on AI model licensing. <a href="https://app.daily.dev/feed-by-ids?id=WwNdGJMJK&amp;id=ft8sQFPsm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Non-human identities critical for cloud security</strong>: Non-Human Identities (NHIs) are essential for securing cloud environments by authenticating machine interactions, with effective management involving discovery, classification, threat detection, and automation for secrets rotation. <a href="https://app.daily.dev/feed-by-ids?id=8oZN72CkV&amp;id=BV9gFLIe6&amp;id=RXhF8YjoA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android Open Source Project changes release schedule</strong>: The Android Open Source Project (AOSP) will shift to a biannual source code release schedule starting in 2026, publishing in Q2 and Q4 to align with trunk stable development cycles, with developers now using the ‘android-latest-release’ branch. <a href="https://app.daily.dev/posts/KKcZfdOWG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI is killing Tailwind CSS, or is it just bad business?</strong>: Tailwind CSS is reportedly facing a business crisis with layoffs and revenue decline, blaming AI for reducing documentation traffic. Apparently, AI drives adoption but doesn’t pay the bills, which is a novel excuse for a business model that relies on people reading docs to discover paid products. Maybe the problem isn’t AI, but the monetization strategy itself, as Kevin Powell points out. <a href="https://app.daily.dev/posts/f3fYUXuKZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Learning C++ in 2026 is a mistake, says expert</strong>: Stefan Mischook boldly declares that learning C++ in 2026 is a mistake, citing diminishing returns and the perils of manual memory management. He suggests pivoting to ‘modern’ languages like JavaScript, C#, or Java for better productivity. Because, you know, nobody needs performance, control, or systems-level programming anymore; everything is a web app now, apparently. <a href="https://app.daily.dev/posts/trj7gVKm4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Senior engineers benefit from AI by avoiding low-quality output</strong>: Matthew Rocklin suggests senior engineers are uniquely positioned to benefit from AI-assisted development by ‘avoiding low-quality output’ while increasing productivity. So, the key to AI success is being good enough to filter out the garbage it produces? Sounds like AI is just another junior dev you have to babysit, but with more tokens and less coffee, as per the Hacker News discussion. <a href="https://app.daily.dev/posts/srWtRgwUR" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
