<h2>Must know</h2>
<ul>
<li>MongoDB vulnerability exposes heap memory data: A critical vulnerability, dubbed “MongoBleed” (CVE-2025-14847), in MongoDB allows unauthenticated remote attackers to read sensitive data directly from the database’s heap memory. This flaw, stemming from improper handling of zlib-compressed network traffic, affects all MongoDB versions since 2017, with active exploitation reported in the wild. While MongoDB Atlas instances are already patched, self-hosted deployments require immediate updates to prevent data exposure, according to security researchers. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Spree e-commerce platform leaks user address data: Two critical vulnerabilities (CVE-2026-22589 and CVE-2026-22588) in the open-source Spree e-commerce platform allow attackers to access and enumerate sensitive user address information. These flaws, caused by insufficient object-level authorization, could lead to large-scale compromise of customer data. Patches are available in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5+, and administrators are urged to update immediately. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Shakapacker vulnerability exposed environment variables: A critical vulnerability in Shakapacker, a JavaScript bundler for Rails, inadvertently exposed all environment variables, including sensitive secrets like database URLs and API keys, to public client-side JavaScript bundles. This issue, present in all versions before 9.5.0, has been resolved by introducing an allowlist for exposed variables. Developers must upgrade to version 9.5.0 and immediately rotate all previously exposed credentials. <a href="https://app.daily.dev/feed-by-ids?id=HJUbnChrN&amp;id=WwNdGJMJK" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li>Dell’s GB10 superchip for edge AI: Dell’s new GB10 device, featuring Nvidia’s Blackwell GB10 superchip, combines a Grace ARM CPU and Blackwell-class GPU with 128GB unified memory, designed for running large language models and advanced reinforcement learning locally without cloud reliance. <a href="https://app.daily.dev/feed-by-ids?id=ow6tBWhoH&amp;id=t9TmWNeD6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Linux kernel 7.0 advances Rust and LTO integration: The upcoming Linux kernel 7.0 is focusing on improved support for building kernels with Rust and Link-Time Optimization (LTO), aiming to enhance performance and code generation for Rust components and their interface with existing C infrastructure. <a href="https://app.daily.dev/posts/eeFdKxuyc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Bun shows strong microservice performance: Bun, a JavaScript runtime built with Zig and JavaScriptCore, ranks 4th overall in microservice benchmarks, outperforming Node.js/Express.js by a factor of 5 in response time and achieving 10x more successful requests per second. <a href="https://app.daily.dev/feed-by-ids?id=MJU0O3aRy&amp;id=TXlo2QmbL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Open-source coding agent platform Kilo released: Kilo is a new open-source coding agent platform that integrates with major IDEs, supports cloud agent operation, automated code review, and parallel execution of AI coding agents with persistent sessions and a pay-as-you-go model for over 500 AI models. <a href="https://app.daily.dev/feed-by-ids?id=ow6tBWhoH&amp;id=t9TmWNeD6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Debian 12.13 and 13.3 point releases address security: Debian released point releases 12.13 and 13.3, addressing numerous security vulnerabilities and bug fixes in critical components like Apache, Git, PostgreSQL, and the Linux kernel, with updates for Intel microcode and NVIDIA drivers. <a href="https://app.daily.dev/posts/C9n67910v" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>GitHub Game Off 2025 winners announced: GitHub’s 13th annual Game Off game jam, themed “WAVES,” announced its top ten winners from over 700 submissions, showcasing diverse interpretations including sound-bending platformers and tide-controlled puzzles, all available open source on <a href="http://itch.io" target="_blank" rel="noopener nofollow">itch.io</a>. <a href="https://app.daily.dev/posts/MwCPwRUfI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Android Open Source Project adjusts release cadence: Starting in 2026, the Android Open Source Project (AOSP) will release source code twice annually, in Q2 and Q4, to align with trunk stable development cycles, directing developers to use the <code>android-latest-release</code> manifest branch for contributions. <a href="https://app.daily.dev/posts/KKcZfdOWG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li>AI coding assistants: slower, buggier, but you’ll feel faster: Turns out, those AI coding assistants you’re using? They make you 19% slower, generate 1.7 times more issues, and reduce refactoring, according to ‘multiple studies.’ But hey, you feel 20% faster because it’s doing all the typing, right? It’s almost like offloading your brain to a glorified autocomplete doesn’t actually make you a better engineer, just a more deluded one. <a href="https://app.daily.dev/posts/fLWmEtnzQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>AI is a business model stress test, especially for open source: Apparently, AI is ‘stress testing’ open-source business models by commoditizing documentation and libraries, leading to companies like Tailwind Labs laying off 75% of their engineering staff after a 40% drop in web traffic. Who knew that if you train an AI on all the internet’s knowledge, people might stop visiting your website for basic info? It’s not like open source ever relied on community engagement or anything. <a href="https://app.daily.dev/feed-by-ids?id=AtqWLuMdt&amp;id=GEG8xCrY5&amp;id=f3fYMXuKZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>OpenAI and Handshake AI want your old work files for ‘training’: OpenAI and Handshake AI are reportedly asking contractors to upload their past work files—Word docs, PDFs, spreadsheets—for AI training, with a ChatGPT-powered tool to ‘scrub’ sensitive info. Because entrusting contractors and an AI to perfectly remove proprietary and PII data from all your old client files sounds like a foolproof plan, right? What could possibly go wrong with that level of trust? <a href="https://app.daily.dev/posts/z0P3L9stb" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>