<h2>Must know</h2>
<ul>
<li><strong>Critical MongoDB vulnerability exposes sensitive data</strong>: A critical vulnerability, CVE-2025-14847 (MongoBleed), has been discovered in MongoDB, allowing unauthenticated attackers to read sensitive data from heap memory due to improper handling of zlib-compressed traffic. All MongoDB versions since 2017 are affected, with active exploitation reported and an estimated 87,000 servers potentially exposed. While MongoDB Atlas instances are patched, self-hosted deployments require immediate manual updates to mitigate this severe risk, as highlighted by security researchers. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform hit by IDOR vulnerabilities</strong>: The Spree e-commerce platform is grappling with two critical IDOR (Insecure Direct Object Reference) vulnerabilities. CVE-2026-22589 allows unauthenticated attackers to access guest user PII, including names and addresses, by manipulating object identifiers. A separate flaw, CVE-2026-22588, enables authenticated users to exploit a similar IDOR to access other users’ address data. Patches are available in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5+, and immediate updates are crucial for affected deployments. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s ChatGPT health raises major privacy concerns</strong>: OpenAI has launched ChatGPT Health in beta, allowing users to integrate medical records for personalized insights, but it’s sparking significant privacy alarms. The service, unavailable in the EU/UK due to privacy laws, is likely not HIPAA-covered, potentially commoditizing user health data for healthcare and insurance companies. This move comes amidst questions about OpenAI’s business model and projected losses, suggesting aggressive monetization strategies, as reported by various news outlets and privacy analyses. <a href="https://app.daily.dev/feed-by-ids?id=0lod4TIIq&amp;id=FGI4Oyps1" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Visual Studio Code introduces experimental agent skills</strong>: Visual Studio Code 1.108 now includes an experimental “Agent Skills” feature, allowing developers to extend GitHub Copilot’s capabilities with custom instructions and resources, enhancing personalization and functionality. <a href="https://app.daily.dev/posts/xn90KJxf1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel 7.0 improves Rust and LTO builds</strong>: The upcoming Linux kernel 7.0 is set to include improvements for building with Rust and Link-Time Optimization (LTO), enhancing performance and code generation for Rust components within the kernel. <a href="https://app.daily.dev/posts/eeFdKxuyc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android Open Source Project shifts release schedule</strong>: Starting in 2026, the Android Open Source Project (AOSP) will release source code twice a year, in Q2 and Q4, aligning with trunk stable development cycles and requiring developers to use the “android-latest-release” manifest branch. <a href="https://app.daily.dev/posts/KKcZfdOWG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Postman acquires Fern for API documentation</strong>: Postman has acquired Fern, integrating its open-source tools for API documentation and SDK generation to enhance the developer experience across multiple programming languages. <a href="https://app.daily.dev/feed-by-ids?id=WwNdGJMJK&amp;id=ft8sQFPsm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SQLite remains a robust embedded database choice</strong>: SQLite, the lightweight, embedded SQL database engine, continues to be a critical component in countless applications, with over a trillion databases in active use, ideal for relational workloads where data resides close to the application. <a href="https://app.daily.dev/posts/x3uMof2DV" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Claude Code 2.1 brings major workflow improvements</strong>: Claude Code 2.1 introduces significant enhancements like forked and asynchronous sub-agents for parallel task execution, automatic skill hot reloading, and session teleportation, streamlining development workflows. <a href="https://app.daily.dev/posts/WChBmOscl" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated code validation still a manual chore</strong>: A Sonar survey reveals that 61% of developers find validating AI-generated code labor-intensive, with only 29% trusting its correctness and 48% manually checking it pre-commit. So much for AI being a magic bullet for productivity; turns out, we’re still stuck doing the grunt work, just now with extra steps to babysit our digital assistants. <a href="https://app.daily.dev/feed-by-ids?id=WwNdGJMJK&amp;id=ft8sQFPsm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Non-human identities: the latest buzzword for cloud security</strong>: Apparently, we now need to manage “Non-Human Identities” (NHIs) in the cloud, which are just machine identities using secrets to access resources. The articles tout benefits like reduced risk and improved compliance, but offer no case studies or empirical data, just a lot of positive framing. It’s almost as if someone just slapped a new label on existing security practices and called it innovation. <a href="https://app.daily.dev/feed-by-ids?id=8oZN72CkV&amp;id=BV9gFLIe6&amp;id=RXhF8YjoA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI wants your old work files for ‘training data’</strong>: OpenAI and Handshake AI are reportedly asking contractors to upload actual work files from past jobs, supposedly after scrubbing proprietary info with a ChatGPT tool. An IP lawyer warns this creates significant legal risk. So, they want you to trust an AI to redact sensitive data from your old projects, then hand it over to train <em>their</em> AI? What could possibly go wrong with that brilliant plan? <a href="https://app.daily.dev/posts/z0P3L9stb" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
