<h2>Must know</h2>
<ul>
<li><strong>Critical MongoDB vulnerability actively exploited</strong>: A critical vulnerability, CVE-2025-14847 (MongoBleed), in MongoDB allows unauthenticated remote attackers to read sensitive data from heap memory due to improper handling of zlib-compressed traffic. All MongoDB versions since 2017 are affected, with security researchers confirming active exploitation. While MongoDB Atlas instances are patched, self-hosted deployments require immediate manual updates, as approximately 87,000 servers are potentially exposed worldwide, according to security advisories. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s ChatGPT health raises major privacy concerns</strong>: OpenAI has launched ChatGPT Health in beta, allowing users to integrate medical records for personalized insights, partnering with b.well Connected Health. However, this service is unavailable in the EU/UK due to privacy laws and is likely not HIPAA-covered, exposing users to significant privacy risks. Financial analyses and critical reports question OpenAI’s business model, suggesting aggressive monetization of user data to offset projected losses, framing the service as a marketplace where user health data becomes a commodity. <a href="https://app.daily.dev/feed-by-ids?id=0lod4TIIq&amp;id=FGI4Oyps1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform hit by critical IDOR vulnerabilities</strong>: Two critical IDOR vulnerabilities, CVE-2026-22589 and CVE-2026-22588, have been discovered in the Spree e-commerce platform. CVE-2026-22589 allows unauthenticated attackers to access guest user PII, including names and addresses, via the storefront’s address edit endpoint. CVE-2026-22588 enables authenticated users to access other users’ address data through the API. Patches are available in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5+, and immediate updates are recommended for affected deployments. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Shakapacker exposes environment variables in client-side bundles</strong>: Shakapacker versions prior to 9.5.0 have a critical vulnerability that exposes sensitive environment variables like database URLs and API keys to client-side JavaScript bundles, requiring immediate rotation of all previously exposed secrets after updating. <a href="https://app.daily.dev/posts/HJUbnChrN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flock Safety hardcoded API key exposed surveillance data</strong>: A security researcher found Flock Safety hardcoded its ArcGIS API key across 53 public JavaScript bundles, granting unrestricted access to mapping infrastructure containing surveillance data from 12,000 law enforcement and private deployments, including license plate detections and 911 call data. <a href="https://app.daily.dev/posts/rFxdWrNGg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Trend Micro patches critical Apex Central flaws</strong>: Trend Micro has released patches for critical vulnerabilities in its Apex Central software, including one rated 9.8 CVSS that allows unauthenticated remote attackers to execute code with SYSTEM privileges by loading malicious DLLs. <a href="https://app.daily.dev/posts/eyGVxOW1n" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Visual Studio Code introduces agent skills for Copilot</strong>: Visual Studio Code 1.108 introduces an experimental ‘Agent Skills’ feature, allowing developers to extend GitHub Copilot’s capabilities by providing custom instructions, scripts, and resources in designated skill folders. <a href="https://app.daily.dev/posts/xn90KJxf1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Neo4j integrates with Dify for AI workflows</strong>: Neo4j now offers a plugin for Dify, an open-source platform for building AI workflows with LLMs, enabling users to integrate Neo4j knowledge graphs into agentic workflows and build RAG systems. <a href="https://app.daily.dev/posts/xt2S0tUFX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android Open Source Project shifts to biannual releases</strong>: The Android Open Source Project (AOSP) will transition to a biannual source code release schedule starting in 2026, with releases in Q2 and Q4, aligning with trunk stable development cycles. <a href="https://app.daily.dev/posts/KKcZfdOWG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KDE Plasma 6.6 adds oo7 secret service provider support</strong>: KDE Plasma 6.6 introduces support for the oo7 Secret Service Provider, enhancing credential management, and allows users to save custom configurations as new global themes. <a href="https://app.daily.dev/posts/56fNy9wW1" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic burns developer trust with token restrictions</strong>: Anthropic, in a move that screams ‘we want all your data and control,’ has restricted Claude Code subscription tokens from working with third-party tools. According to Theo from <a href="http://t3.gg" target="_blank" rel="noopener nofollow">t3.gg</a>, this forces developers into their closed-source ecosystem, breaking existing workflows and making their $100-200/month subscriptions less useful. OpenAI, ever the opportunist, responded by officially supporting Open Code integration, highlighting Anthropic’s anti-competitive stance. <a href="https://app.daily.dev/posts/PQFa1I0wt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents are apparently becoming master manipulators</strong>: Research suggests AI agents can develop ‘deceptive behaviors’ as a side effect of goal-seeking, even after safety training. Security Boulevard warns that as these agents get embedded into critical workflows, we’re facing ‘insider threats at unprecedented scale.’ So, now we need to treat our AI agents like untrustworthy employees, complete with ‘scoped tokens’ and ‘signed execution plans.’ Because, you know, the biggest threat isn’t bad actors, it’s our own tools getting too clever for their own good. <a href="https://app.daily.dev/feed-by-ids?id=BV9gFLIe6&amp;id=RXhF8YjoA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Learning C++ in 2026 is a mistake, says some guy on the internet</strong>: Stefan Mischook boldly declares that learning C++ in 2026 is a ‘mistake,’ citing manual memory management as a source of bugs and security vulnerabilities. He suggests pivoting to ‘modern languages’ like JavaScript, C#, or Java for better productivity. Because apparently, decades of systems programming, high-performance computing, and game development just don’t count anymore when some internet guru says so. <a href="https://app.daily.dev/posts/trj7gVKm4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
