<h2>Must know</h2>
<ul>
<li><strong>Critical MongoDB vulnerability actively exploited</strong>: A critical vulnerability, CVE-2025-14847 (MongoBleed), has been discovered in MongoDB, allowing unauthenticated remote attackers to read sensitive data from heap memory. All MongoDB versions since 2017 are affected, with security researchers confirming active exploitation. Approximately 87,000 servers are potentially exposed worldwide, and while MongoDB Atlas instances are patched, self-hosted deployments require immediate manual updates, as reported by security research disclosures. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s ChatGPT health raises major privacy concerns</strong>: OpenAI has launched ChatGPT Health in beta, allowing users to integrate medical records for personalized insights. However, this initiative is raising significant privacy alarms, particularly as it’s likely not covered by HIPAA and is unavailable in the EU/UK due to privacy law constraints. Critics, including investigative reports, suggest OpenAI’s business model may commoditize user health data, especially given projected financial losses, highlighting a concerning trend in AI monetization. <a href="https://app.daily.dev/feed-by-ids?id=0lod4TIIq&amp;id=FGI4Oyps1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform hit by critical IDOR vulnerabilities</strong>: Two critical IDOR (Insecure Direct Object Reference) vulnerabilities, CVE-2026-22589 and CVE-2026-22588, have been found in the Spree e-commerce platform. These flaws allow attackers to access sensitive user PII, including names and addresses, either unauthenticated or with authentication, by manipulating object identifiers. Patches are available in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5+, and immediate updates are recommended for affected deployments. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Visual Studio Code adds agent skills for Copilot customization</strong>: Visual Studio Code 1.108 introduces an experimental ‘Agent Skills’ feature, allowing developers to extend GitHub Copilot’s capabilities with custom instructions and resources, enhancing AI agent knowledge base construction. <a href="https://app.daily.dev/posts/xn90KJxf1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ollama 0.14 enables AI to run bash commands</strong>: Ollama 0.14-rc2 now includes an experimental agent loop mode, letting LLMs execute bash commands and perform web searches on your system with user approval, enhancing local Docker development environments and AI penetration testing agents. <a href="https://app.daily.dev/posts/b5gNbsldC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Neo4j integrates with Dify for AI workflows</strong>: Neo4j has released a plugin for Dify, an open-source platform for building AI workflows, enabling integration of Neo4j knowledge graphs into agentic workflows for enhanced knowledge graph construction. <a href="https://app.daily.dev/posts/xt2S0tUFX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Shakapacker vulnerability exposes secrets in client-side bundles</strong>: Shakapacker versions prior to 9.5.0 have a critical vulnerability that exposes environment variables, including sensitive credentials, to client-side JavaScript bundles, highlighting a significant security risk. <a href="https://app.daily.dev/posts/HJUbnChrN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel 7.0 improves Rust and LTO builds</strong>: Linux kernel 7.0 is set to include improvements for building kernels with Rust and Link-Time Optimization (LTO), enhancing performance for Rust-based terminal applications. <a href="https://app.daily.dev/posts/eeFdKxuyc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Postman acquires Fern for API documentation and SDK generation</strong>: Postman has acquired Fern, integrating open-source API documentation and SDK generation tools to enhance developer experience, which could impact Notion API and Google Drive API integrations. <a href="https://app.daily.dev/posts/WwNdGJMJK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android Open Source Project shifts to biannual releases</strong>: The Android Open Source Project (AOSP) will transition to a biannual source code release schedule starting in 2026, publishing updates in Q2 and Q4 to align with stable development cycles. <a href="https://app.daily.dev/posts/KKcZfdOWG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated code validation: trust but verify, or just verify?</strong>: A Sonar survey reveals that 61% of developers find AI-generated code validation labor-intensive, and only 29% trust its correctness, with 48% manually checking code pre-commit. So, while AI is supposed to make us more productive, it seems we’re just adding another layer of manual review to ensure the AI didn’t hallucinate a security flaw or a logic bomb. Maybe we should just write the code ourselves and save the validation step. <a href="https://app.daily.dev/posts/WwNdGJMJK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Tailwind CSS: AI’s unintended victim?</strong>: Kevin Powell reports that Tailwind CSS is facing a business crisis, with layoffs and revenue decline, despite growing popularity. Apparently, AI has reduced their documentation traffic by 40% since 2023, creating a paradox where AI drives adoption but kills the monetization path. It seems AI is so good at consuming content, it’s starving the very projects it relies on. Who knew AI could be so inconsiderate? <a href="https://app.daily.dev/posts/f3fYMXuKZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Non-human identities: the next big thing in cloud security, or just more buzzwords?</strong>: Multiple articles are hyping Non-Human Identities (NHIs) as critical for securing cloud environments, with claims of reduced security risk, improved regulatory compliance, and increased operational efficiency. While managing machine identities is important, the articles offer conceptual overviews without empirical data or case studies. It sounds like another marketing push for something that should already be standard practice, now with added ‘Agentic AI’ for extra flavor. <a href="https://app.daily.dev/feed-by-ids?id=8oZN72CkV&amp;id=BV9gFLIe6&amp;id=RXhF8YjoA" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
