<h2>Must know</h2>
<ul>
<li><strong>Critical MongoDB vulnerability exposes heap memory</strong>: MongoDB patched a critical vulnerability, CVE-2025-14847, dubbed “MongoBleed,” allowing unauthenticated remote attackers to read sensitive data from heap memory due to improper handling of zlib-compressed network traffic. All MongoDB versions since 2017 are affected, with active exploitation reported in the wild and approximately 87,000 servers potentially exposed. Self-hosted deployments require immediate patching, while MongoDB Atlas instances are already secured. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform leaks user address data</strong>: Two critical vulnerabilities (CVE-2026-22589 and CVE-2026-22588) in the open-source Spree e-commerce platform allow attackers to access and enumerate user address information. These flaws stem from insufficient object-level authorization, enabling unauthenticated access to guest data and authenticated API users to manipulate other users’ addresses. Patches are available in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5+, and immediate updates are advised to prevent large-scale data compromise. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Shakapacker vulnerability exposes environment variables</strong>: A critical vulnerability in Shakapacker, a JavaScript bundler for Rails, inadvertently exposed all environment variables, including sensitive secrets like database URLs and API tokens, to public client-side JavaScript bundles since 2017. The issue is resolved in version 9.5.0, which now uses an allowlist for exposed variables. Developers must upgrade immediately and rotate all previously exposed credentials, as reported by various security outlets. <a href="https://app.daily.dev/feed-by-ids?id=HJUbnChrN&amp;id=WwNdGJMJK" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Linux kernel 7.0 boosts Rust and LTO integration</strong>: Linux kernel 7.0 is enhancing support for Rust and Link-Time Optimization (LTO) builds, with Google engineers improving how C helper functions integrate into Rust code for better performance and code generation within the kernel. <a href="https://app.daily.dev/posts/eeFdKxuyc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bun excels in microservice benchmarks</strong>: Bun, a JavaScript runtime built with Zig and JavaScriptCore, ranks 4th overall in microservice performance benchmarks, outperforming Node.js/Express.js by a factor of 5 in response time and 10x in requests per second, while maintaining 100% stability. <a href="https://app.daily.dev/feed-by-ids?id=MJU0O3aRy&amp;id=TXlo2QmbL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ollama 0.14 adds experimental bash execution and image generation</strong>: Ollama 0.14-rc2 introduces an experimental agent mode allowing LLMs to execute bash commands and perform web searches on user systems with interactive approval, alongside experimental image generation via the Z-Image model. <a href="https://app.daily.dev/feed-by-ids?id=Sb7YSA4iI&amp;id=b5gNbsldC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Dell’s GB10 superchip targets edge AI</strong>: Dell’s GB10 device, featuring Nvidia’s Blackwell GB10 superchip, is designed for running large language models and local video analytics at the edge, leveraging unified memory and FP4 precision for high-efficiency AI workflows without cloud reliance. <a href="https://app.daily.dev/feed-by-ids?id=ow6tBWhoH&amp;id=t9TmWNeD6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Debian 12.13 and 13.3 point releases address security</strong>: Debian released point releases 12.13 and 13.3, delivering critical security fixes and bug patches for major components like Apache, Git, PostgreSQL, and the Linux kernel, addressing vulnerabilities such as buffer overflows and SQL injection. <a href="https://app.daily.dev/posts/C9n67910v" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>MuddyWater deploys RustyWater RAT in Middle East attacks</strong>: Iranian threat actor MuddyWater is using a new Rust-developed remote access trojan (RAT) called RustyWater in spear-phishing campaigns targeting diplomatic, maritime, financial, and telecommunications organizations in the Middle East. <a href="https://app.daily.dev/posts/w5TRLvoKW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New open-source coding agent platform Kilo emerges</strong>: Kilo is an open-source coding agent platform integrating with major IDEs, offering cloud agent operation, automated code review, codebase deployment, and parallel execution of AI coding agents with persistent sessions and transparent pay-as-you-go pricing. <a href="https://app.daily.dev/feed-by-ids?id=ow6tBWhoH&amp;id=t9TmWNeD6" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding assistants make you slower, but you’ll feel faster</strong>: Turns out, those AI coding assistants you’re so excited about actually make developers 19% slower on tasks, despite a subjective feeling of being 20% faster. Not only that, but AI-generated code produces 1.7 times more issues and increases code churn. So, while you’re busy feeling like a coding god, you’re actually just creating more work for your future self, according to multiple studies. Who needs actual productivity when you have the illusion of it? <a href="https://app.daily.dev/posts/fLWmEtnzQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Windows 11: the slowest Windows in 25 years, according to one YouTuber</strong>: Microsoft keeps telling us Windows 11 is the ‘fastest Windows ever,’ but a YouTuber’s benchmarks on a Lenovo ThinkPad X220 suggest otherwise. Apparently, it’s the slowest in boot times, app launches, and video editing compared to every Windows version since XP. The only thing it’s good at is file transfer speed and hogging RAM. So much for progress, I guess, unless you’re only transferring files and have infinite memory. <a href="https://app.daily.dev/posts/pN49SBVqk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic burns developer trust with Claude Code restrictions</strong>: Anthropic decided to restrict Claude Code subscription tokens from working with third-party tools, forcing developers into their official harness. This move, which breaks existing workflows for users paying $100-200/month, is being framed as a way to lock users into Anthropic’s closed-source ecosystem. Meanwhile, OpenAI is busy officially supporting Open Code integration. It’s almost like Anthropic forgot who builds the ecosystem they rely on, as noted by Theo - <a href="http://t3.gg" target="_blank" rel="noopener nofollow">t3.gg</a>. <a href="https://app.daily.dev/posts/PQFa1I0wt" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
