<h2>Must know</h2>
<ul>
<li><strong>MongoDB vulnerability exposes sensitive data</strong>: A critical vulnerability, CVE-2025-14847 (MongoBleed), in MongoDB allows unauthenticated remote attackers to read sensitive data from heap memory due to improper handling of zlib-compressed network traffic. All MongoDB versions since 2017 are affected, with security researchers confirming active exploitation and an estimated 87,000 servers potentially exposed worldwide. While MongoDB Atlas instances are patched, self-hosted deployments require immediate manual updates, as reported by various security research disclosures. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s ChatGPT health raises privacy alarms</strong>: OpenAI has launched ChatGPT Health in beta, allowing users to integrate medical records for personalized insights, partnering with b.well Connected Health. However, this service is unavailable in the EU/UK due to privacy law constraints, and critics argue it’s likely not HIPAA-covered, potentially commoditizing user data for healthcare and insurance companies. Financial analyses also question OpenAI’s business model, projecting significant losses and suggesting aggressive monetization strategies, as highlighted in various news and investigative reports. <a href="https://app.daily.dev/feed-by-ids?id=0lod4TIIq&amp;id=FGI4Oyps1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform has critical IDOR vulnerabilities</strong>: Two critical IDOR (Insecure Direct Object Reference) vulnerabilities, CVE-2026-22589 and CVE-2026-22588, have been found in the Spree e-commerce platform. These flaws allow attackers, both unauthenticated and authenticated, to access and enumerate sensitive user PII like names and addresses by manipulating object identifiers. Patches are available in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5+, and users of affected versions are urged to update immediately, according to vulnerability disclosures. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI shifts source of truth from code to traces</strong>: For AI agents, the source of truth moves from static code to runtime traces, meaning debugging, testing, and optimization now revolve around analyzing decision patterns and reasoning chains captured during execution, rather than just the codebase. <a href="https://app.daily.dev/posts/4345MlXhv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Visual Studio Code introduces agent skills for Copilot</strong>: Visual Studio Code 1.108 now includes an experimental ‘Agent Skills’ feature, allowing developers to extend GitHub Copilot’s capabilities by providing custom instructions, scripts, and resources in designated skill folders. <a href="https://app.daily.dev/posts/xn90KJxf1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open source ecosystem sees acquisitions and security updates</strong>: Postman acquired Fern to enhance API documentation, React Router disclosed six security vulnerabilities, and Google established a Bluesky presence for open source engagement, while community debates continue on AI model licensing. <a href="https://app.daily.dev/feed-by-ids?id=WwNdGJMJK&amp;id=ft8sQFPsm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android Open Source Project changes release schedule</strong>: Starting in 2026, the Android Open Source Project (AOSP) will release source code twice a year, in Q2 and Q4, aligning with trunk stable development cycles, with developers instructed to use the “android-latest-release” manifest branch. <a href="https://app.daily.dev/posts/KKcZfdOWG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Neo4j integrates with Dify for AI workflows</strong>: Neo4j now offers a plugin for Dify, an open-source platform for building LLM workflows, enabling the integration of Neo4j knowledge graphs into agentic applications through a visual interface for tasks like dynamic Cypher query generation. <a href="https://app.daily.dev/posts/xt2S0tUFX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Non-human identities critical for cloud security</strong>: Non-Human Identities (NHIs), such as tokens and keys, are essential for securing cloud environments by authenticating system interactions, with effective management involving discovery, classification, threat detection, and automation for compliance and efficiency. <a href="https://app.daily.dev/feed-by-ids?id=8oZN72CkV&amp;id=BV9gFLIe6&amp;id=RXhF8YjoA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Thumbtack uses GenAI on Databricks for message review</strong>: Thumbtack has unified its GenAI ecosystem on Databricks to create a semi-automated message review pipeline, combining a CNN pre-filter with a fine-tuned LLM to screen millions of messages between homeowners and service professionals, improving detection precision and recall. <a href="https://app.daily.dev/posts/1ImnnS3p7" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>OpenAI wants your old work for ‘training’</strong>: OpenAI and Handshake AI are reportedly asking contractors to upload past work files for AI training, with the brilliant idea of having contractors use a ChatGPT tool to scrub proprietary info. Because, clearly, a contractor is the best judge of legal confidentiality, and an AI scrubbing tool is foolproof. What could possibly go wrong with this intellectual property minefield, as warned by actual lawyers? <a href="https://app.daily.dev/posts/z0P3L9stb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI is killing Tailwind’s business model, apparently</strong>: Tailwind CSS is facing layoffs and revenue decline, blaming AI for reducing documentation traffic by 40% while paradoxically increasing framework usage. So, AI drives adoption but eats the monetization path—a classic case of ‘be careful what you wish for’ when your business relies on people actually visiting your website. Maybe next time, try a business model that isn’t cannibalized by the very tech you’re trying to leverage. <a href="https://app.daily.dev/posts/f3fYMXuKZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Learning C++ in 2026 is a ‘mistake’</strong>: According to some, learning C++ in 2026 is a ‘mistake’ because of its ‘diminishing returns’ and ‘manual memory management’ that leads to bugs. Apparently, modern languages like JavaScript, C#, or Java offer ‘better productivity without the complexity overhead.’ It’s almost as if different tools exist for different jobs, and some of us actually enjoy understanding how things work under the hood, rather than just slapping together another web app. <a href="https://app.daily.dev/posts/trj7gVKm4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
