<h2>Must know</h2>
<ul>
<li><strong>MongoDB vulnerability exposes sensitive data</strong>: A critical vulnerability, CVE-2025-14847 (MongoBleed), in MongoDB allows unauthenticated attackers to read sensitive data from heap memory due to improper handling of zlib-compressed traffic. All MongoDB versions since 2017 are affected, with active exploitation reported and an estimated 87,000 servers potentially exposed. While MongoDB Atlas instances are patched, self-hosted deployments require immediate manual updates, as highlighted by security researchers. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform has critical IDOR vulnerabilities</strong>: The Spree e-commerce platform is grappling with two critical IDOR vulnerabilities. CVE-2026-22589 allows unauthenticated attackers to access guest user PII via the address edit endpoint, while CVE-2026-22588 enables authenticated users to access other users’ address data through the API. Patches are available in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5+, and users are urged to update immediately to mitigate these risks. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s ChatGPT health raises privacy concerns</strong>: OpenAI has launched ChatGPT Health in beta, allowing users to integrate medical records for personalized insights, partnering with b.well Connected Health. However, the service is unavailable in the EU/UK due to privacy laws, and critics argue it’s not HIPAA-covered, potentially commoditizing user data for healthcare and insurance companies. This move comes amidst questions about OpenAI’s business model and projected losses, as reported by various news outlets. <a href="https://app.daily.dev/feed-by-ids?id=0lod4TIIq&amp;id=FGI4Oyps1" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Visual Studio Code adds agent skills for Copilot</strong>: Visual Studio Code 1.108 introduces ‘Agent Skills’ as an experimental feature, allowing developers to extend GitHub Copilot’s capabilities by providing custom instructions, scripts, and resources in ‘.github/skills’ directories. <a href="https://app.daily.dev/posts/xn90KJxf1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Drupal 11.3.0 boosts performance and adds HTMX support</strong>: Drupal 11.3.0 delivers a significant performance boost, serving 26-33% more requests, and introduces native HTMX support to reduce JavaScript weight by up to 71%, alongside a stable Navigation module and improved CKEditor. <a href="https://app.daily.dev/posts/qoxLrj7Wb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Shakapacker vulnerability leaks environment variables</strong>: Shakapacker versions before 9.5.0 have a critical vulnerability that exposes sensitive environment variables like database credentials and API keys to client-side bundles due to <code>webpack.EnvironmentPlugin(process.env)</code>. <a href="https://app.daily.dev/posts/HJUbnChrN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Postman acquires Fern to enhance API development</strong>: Postman has acquired Fern, integrating its open-source API documentation and SDK generation tools to improve the developer experience across multiple programming languages. <a href="https://app.daily.dev/feed-by-ids?id=WwNdGJMJK&amp;id=ft8sQFPsm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel 7.0 improves Rust and LTO builds</strong>: Linux kernel 7.0 is set to include improvements for building kernels with Rust and Link-Time Optimization (LTO), enhancing performance and code generation for Rust components. <a href="https://app.daily.dev/posts/eeFdKxuyc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Neo4j integrates with Dify for AI workflows</strong>: Neo4j now offers a plugin for Dify, an open-source platform for building AI workflows with LLMs, enabling integration of knowledge graphs into agentic workflows for RAG systems. <a href="https://app.daily.dev/posts/xt2S0tUFX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android Open Source Project changes release schedule</strong>: The Android Open Source Project (AOSP) will shift to a biannual source code release schedule starting in 2026, publishing in Q2 and Q4 to align with trunk stable development cycles. <a href="https://app.daily.dev/posts/KKcZfdOWG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI is not replacing developers, says expert</strong>: Stefan Mischook, a seasoned developer, argues that AI models, being mere pattern recognition systems, lack the logical reasoning to replace human developers. He points to model fragility, inconsistent progress between versions (GPT-4 to GPT-5 apparently ‘broke existing implementations’), and poor performance on novel problems as evidence. So, while AI can be a ‘productivity tool,’ it still needs a human to clean up its mess and make actual architectural decisions. Shocking, I know. <a href="https://app.daily.dev/posts/trj7gVKm4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The ‘non-human identity’ security hype train</strong>: Apparently, ‘Non-Human Identities’ (NHIs) are the new hotness in cybersecurity, with AI agents increasing their ‘volumes and complexity,’ exposing ‘unmanaged credentials.’ CrowdStrike even dropped $740M on SGNL to tackle this ‘growth in identity-based attacks.’ It’s almost like we’ve been managing machine accounts and service principals for decades, but now that AI is involved, it’s a whole new, terrifying, and expensive problem. Who knew that giving machines broad, static permissions was a bad idea? <a href="https://app.daily.dev/feed-by-ids?id=8oZN72CkV&amp;id=BV9gFLIe6&amp;id=RXhF8YjoA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Has AI killed Tailwind CSS’s business model?</strong>: Tailwind CSS is reportedly facing a business crisis, with 75% staff layoffs and 80% revenue decline, despite growing popularity. The company claims AI has reduced documentation traffic by 40% since 2023, creating a paradox where AI drives adoption but undermines the monetization path through documentation. It seems LLMs are great at consuming content but not so great at driving traffic to the original sources, threatening the sustainability of open-source projects that rely on documentation-based business models. Who could have seen that coming? <a href="https://app.daily.dev/posts/f3fYMXuKZ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
