<h2>Must know</h2>
<ul>
<li><strong>Anthropic’s Claude Code update and developer backlash</strong>: Anthropic released Claude Code 2.1 with significant workflow improvements like forked sub-agents, automatic skill hot reloading, and persistent memory. However, the company also restricted the use of Claude Code subscription tokens with third-party tools, forcing users into their official harness. This move, reported by Theo from <a href="http://t3.gg" target="_blank" rel="noopener nofollow">t3.gg</a>, has sparked considerable developer backlash, with many viewing it as anti-competitive and a breach of trust, especially as OpenAI officially supports third-party integrations. <a href="https://app.daily.dev/feed-by-ids?id=WChBmOscl&amp;id=PQFa1I0wt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical MongoDB vulnerability exposes heap memory</strong>: MongoDB patched a critical vulnerability, CVE-2025-14847, dubbed ‘MongoBleed,’ which allows unauthenticated remote attackers to read sensitive data from the database’s heap memory. This flaw, stemming from improper handling of zlib-compressed network traffic, affects all MongoDB versions since 2017. Active exploitation has been reported, and security researchers estimate 42% of cloud environments and 87,000 servers are potentially exposed, necessitating immediate patching for self-hosted deployments. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI is a business model stress test for open source</strong>: AI is fundamentally disrupting open-source monetization by commoditizing documentation and libraries, which LLMs can now generate on demand. Tailwind Labs, for instance, saw a 40% drop in web traffic and laid off 75% of its engineering staff as developers turned to AI for code instead of traditional documentation, as reported by Kevin Powell. This shift means open-source businesses must now differentiate through operational services like deployment and security, rather than just code delivery. <a href="https://app.daily.dev/feed-by-ids?id=AtqWLuMdt&amp;id=GEG8xCrY5&amp;id=f3fYMXuKZ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI coding assistants: Perceived productivity vs. actual performance</strong>: Despite developers feeling 20% faster with AI coding assistants, research indicates they actually take 19% longer on tasks and produce 1.7 times more issues, leading to increased code churn and reduced refactoring. <a href="https://app.daily.dev/posts/fLWmEtnzQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Shakapacker vulnerability exposed environment variables</strong>: A critical vulnerability in Shakapacker, a JavaScript bundler for Rails, inadvertently exposed all environment variables, including sensitive secrets, to public client-side JavaScript bundles in all versions before 9.5.0. <a href="https://app.daily.dev/posts/HJUbnChrN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform exposes user address data</strong>: Two critical vulnerabilities (CVE-2026-22589 and CVE-2026-22588) in the Spree e-commerce platform allow unauthenticated attackers to access guest user address information and authenticated API users to access other users’ addresses due to insufficient authorization checks. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bun shows strong performance in microservice benchmarks</strong>: Bun, a JavaScript runtime built with Zig and JavaScriptCore, ranks 4th overall in microservice framework performance, outperforming Node.js/Express.js by a factor of 5 in response time and achieving 10x more successful requests per second. <a href="https://app.daily.dev/feed-by-ids?id=MJU0O3aRy&amp;id=TXlo2QmbL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Debian point releases address security and stability</strong>: Debian released 12.13 and 13.3 point releases, addressing numerous security vulnerabilities and bug fixes in critical components like Apache, Git, PostgreSQL, and the Linux kernel, with updates for Intel microcode and NVIDIA drivers. <a href="https://app.daily.dev/posts/C9n67910v" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel 7.0 advances Rust and LTO integration</strong>: The upcoming Linux kernel 7.0 is focusing on improved support for building kernels with Rust and Link-Time Optimization (LTO), aiming to enhance performance and code generation for Rust components and their interface with C infrastructure. <a href="https://app.daily.dev/posts/eeFdKxuyc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ollama 0.14-rc2 introduces experimental LLM agent features</strong>: Ollama 0.14-rc2 now includes an experimental mode allowing LLMs to execute bash commands and perform web searches on user systems with interactive safety interventions, alongside experimental image generation via the Z-Image model. <a href="https://app.daily.dev/feed-by-ids?id=Sb7YSA4iI&amp;id=b5gNbsldC" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>OpenAI and Handshake AI want your old work files for AI training, trust you to scrub sensitive data</strong>: OpenAI and Handshake AI are reportedly asking contractors to upload past work files (Word, PDFs, spreadsheets) for AI training, with a ChatGPT-powered tool supposedly helping to remove proprietary and PII. So, they’re outsourcing the critical task of data sanitization to contractors and an AI tool, rather than, you know, doing it themselves. What could possibly go wrong when you rely on an unnamed lawyer’s ‘concerns’ about accidental data exposure? <a href="https://app.daily.dev/posts/z0P3L9stb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Windows 11: The ‘fastest Windows ever’ is now the slowest in 25 years</strong>: Microsoft claimed Windows 11 was the ‘fastest Windows ever,’ but a YouTuber’s benchmarks on a Lenovo ThinkPad X220 show it’s actually the slowest in boot times, app launches, and video editing compared to every version since XP. Apparently, all those ‘AI-integrated features’ and background services are really helping with performance. Who needs speed when you have more bloat, right? <a href="https://app.daily.dev/posts/pN49SBVqk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Agentic AI for NHI management: The solution to problems you didn’t know you had</strong>: Apparently, ‘Agentic AI’ is the new magic bullet for managing ‘Non-Human Identities’ (NHIs) in critical systems, promising enhanced security, compliance, and cost savings. These articles, suspiciously similar in their promotional framing, claim AI will analyze usage patterns and provide ‘context-aware risk insights’ beyond basic secret scanning. It’s almost as if they’re trying to sell us a solution to a problem that sounds important but lacks any empirical evidence or real-world examples of its supposed benefits. <a href="https://app.daily.dev/feed-by-ids?id=R1pVL2eyW&amp;id=aQiBkkPBe" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
