<h2>Must know</h2>
<ul>
<li><strong>Critical MongoDB vulnerability exposes sensitive data</strong>: A critical vulnerability, CVE-2025-14847 (MongoBleed), in MongoDB allows unauthenticated remote attackers to read sensitive data from heap memory due to improper handling of zlib-compressed traffic. All MongoDB versions since 2017 are affected, with active exploitation reported and an estimated 87,000 servers potentially exposed. While MongoDB Atlas instances are patched, self-hosted deployments require immediate manual updates, as highlighted by security researchers. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s ChatGPT health raises major privacy concerns</strong>: OpenAI is launching ChatGPT Health in beta, allowing users to integrate medical records for personalized insights, partnering with b.well Connected Health. However, this service is unavailable in the EU/UK due to privacy laws and is likely not HIPAA-covered, raising significant concerns about user data commoditization. Financial analyses suggest OpenAI’s aggressive monetization strategy might be driven by projected losses, as reported by various news outlets and privacy analyses. <a href="https://app.daily.dev/feed-by-ids?id=0lod4TIIq&amp;id=FGI4Oyps1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Shakapacker leaks environment variables to client-side bundles</strong>: Shakapacker versions prior to 9.5.0 have a critical vulnerability where <code>webpack.EnvironmentPlugin(process.env)</code> exposes all environment variables, including sensitive credentials like database URLs and API keys, to client-side JavaScript bundles. This issue, present since 2017, is fixed in version 9.5.0 by implementing an allowlist. Developers must upgrade and rotate all previously exposed secrets, as detailed in the GHSA advisory. <a href="https://app.daily.dev/posts/HJUbnChrN" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Visual Studio Code introduces agent skills for Copilot</strong>: Visual Studio Code 1.108 includes an experimental ‘Agent Skills’ feature, allowing developers to extend GitHub Copilot’s capabilities by providing custom instructions, scripts, and resources in <code>.github/skills</code> directories. <a href="https://app.daily.dev/posts/xn90KJxf1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform hit by IDOR vulnerabilities</strong>: The Spree e-commerce platform has critical IDOR vulnerabilities (CVE-2026-22589 and CVE-2026-22588) that expose guest and authenticated user PII, including addresses, through authorization flaws in versions prior to 4.10.2, 5.0.7, 5.1.9, and 5.2.5+. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Drupal 11.3.0 brings major performance and feature boosts</strong>: Drupal 11.3.0 offers a significant performance increase (26-33% more requests), native HTMX support to reduce JavaScript weight, a stable Navigation module, and experimental MySQLi driver for parallel query execution. <a href="https://app.daily.dev/posts/qoxLrj7Wb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flock Safety hardcoded surveillance infrastructure passwords</strong>: A security researcher found Flock Safety hardcoded ArcGIS API keys across 53 public JavaScript bundles, granting unrestricted access to mapping infrastructure containing surveillance data from 12,000 deployments, exposing license plate detections, drone telemetry, and 911 call data. <a href="https://app.daily.dev/posts/rFxdWrNGg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Neo4j integrates with Dify for AI workflows</strong>: Neo4j now offers a plugin for Dify, an open-source platform for building AI workflows, enabling integration of knowledge graphs into agentic workflows for dynamic Cypher query generation and RAG systems. <a href="https://app.daily.dev/posts/xt2S0tUFX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PHP SDK for xAI’s APIs released</strong>: An unofficial PHP SDK for xAI’s APIs is now available, offering full feature parity with the official Python SDK, including chat completions, streaming, image understanding, function calling, and OpenTelemetry integration for PHP 8.4+. <a href="https://app.daily.dev/posts/xPuLJ0NJN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android Open Source Project shifts to biannual releases</strong>: The Android Open Source Project (AOSP) will transition to a biannual source code release schedule starting in 2026, with releases in Q2 and Q4, aligning with trunk stable development cycles and requiring developers to use the ‘android-latest-release’ manifest branch. <a href="https://app.daily.dev/posts/KKcZfdOWG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI code validation: developers still doing the heavy lifting</strong>: A Sonar survey reveals 61% of developers find AI-generated code validation labor-intensive, with only 29% trusting its correctness and 48% manually checking code pre-commit. So much for AI being a magic bullet for productivity; looks like we’re still stuck doing the grunt work, just with more steps, according to this ‘insightful’ survey. <a href="https://app.daily.dev/posts/WwNdGJMJK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Learning C++ in 2026: a ‘mistake’ says the expert</strong>: According to Stefan Mischook, learning C++ in 2026 is a ‘mistake’ due to its time investment and manual memory management leading to bugs. Apparently, modern languages like JavaScript, C#, or Java offer ‘better productivity’ without the ‘complexity overhead.’ Because, you know, JavaScript is famously simple and bug-free, and nobody ever writes performant, critical systems in C++ anymore. <a href="https://app.daily.dev/posts/trj7gVKm4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Hack The Box CTF: AI clients and MCP, still no flags</strong>: One poor soul documented their multi-day struggle setting up an MCP environment with AI clients like Cursor IDE and Claude Code for a Hack The Box CTF. Despite all the cutting-edge tech and Anthropic API credits, they couldn’t capture a single flag. It seems even with all the AI hype, good old-fashioned CTF skills and timely setup still matter more than throwing LLMs at the problem. <a href="https://app.daily.dev/posts/v1uCfzI3j" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
