<h2>Must know</h2>
<ul>
<li><strong>Critical MongoDB vulnerability exposed heap memory data</strong>: MongoDB patched a critical vulnerability, CVE-2025-14847, dubbed “MongoBleed,” allowing unauthenticated remote attackers to read sensitive data from MongoDB’s heap memory. This flaw, with a CVSS score of 8.7, affects all MongoDB versions since 2017 due to improper handling of zlib-compressed network traffic. Active exploitation has been reported, and approximately 87,000 servers are potentially exposed, according to security researchers. Self-hosted deployments require immediate patching, while MongoDB Atlas instances are already secured. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Shakapacker vulnerability exposed environment variables</strong>: A critical vulnerability in Shakapacker, a JavaScript bundler for Rails, inadvertently exposed sensitive environment variables like database URLs and API tokens to public client-side JavaScript bundles since 2017. The issue, resolved in version 9.5.0, stemmed from <code>webpack.EnvironmentPlugin(process.env)</code> passing all variables by default. Developers must now rotate all previously exposed secrets and use an allowlist for public variables, as detailed in the RubyLand report. <a href="https://app.daily.dev/feed-by-ids?id=HJUbnChrN&amp;id=WwNdGJMJK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform exposed user address data</strong>: Two critical vulnerabilities (CVE-2026-22589 and CVE-2026-22588) in the open-source Spree e-commerce platform allowed unauthenticated attackers to access guest user address information and authenticated API users to manipulate other users’ addresses. These flaws, caused by insufficient object-level authorization, could lead to large-scale compromise of customer PII. Patches are available in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5+. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Linux kernel 7.0 advances Rust and LTO integration</strong>: The Linux kernel 7.0 is in development, focusing on improved support for building kernels with Rust and Link-Time Optimization (LTO), aiming to enhance performance and code generation for Rust components. <a href="https://app.daily.dev/posts/eeFdKxuyc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bun shows strong performance in microservice benchmarks</strong>: Bun, a JavaScript runtime built with Zig and JavaScriptCore, ranks 4th overall in microservice framework performance, outperforming Node.js/Express.js by a factor of 5 in response time and 10x in requests per second. <a href="https://app.daily.dev/feed-by-ids?id=MJU0O3aRy&amp;id=TXlo2QmbL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Dell’s GB10 superchip targets edge AI</strong>: Dell’s GB10 device, featuring Nvidia’s Blackwell GB10 superchip, is designed for running large language models and advanced reinforcement learning at the edge, leveraging unified memory for high-efficiency AI workflows. <a href="https://app.daily.dev/posts/ow6tBWhoH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kilo open-source coding agent platform released</strong>: Kilo is a new open-source coding agent platform integrating with major IDEs, offering cloud agent operation, automated code review, codebase deployment, and parallel execution of AI coding agents with a pay-as-you-go model. <a href="https://app.daily.dev/posts/t9TmWNeD6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Debian 12.13 and 13.3 point releases address security</strong>: Debian released 12.13 and 13.3 point releases, addressing numerous security vulnerabilities and bug fixes in critical components like Apache, Git, PostgreSQL, and the Linux kernel, with updates for Intel microcode and NVIDIA drivers. <a href="https://app.daily.dev/posts/C9n67910v" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android Open Source Project adjusts release cadence</strong>: AOSP will shift to a twice-annual source code publication schedule starting in 2026, releasing in Q2 and Q4, to better align with trunk stable development cycles, directing developers to use the <code>android-latest-release</code> branch. <a href="https://app.daily.dev/posts/KKcZfdOWG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New unofficial PHP SDK for xAI’s APIs</strong>: DisplaceTech released an unofficial PHP SDK for xAI’s APIs, offering full feature parity with the official Python SDK, including chat, streaming, image processing, and RAG, with OpenTelemetry integration and Composer installation. <a href="https://app.daily.dev/posts/xPuLJ0NJN" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding assistants: faster to fail?</strong>: Turns out, developers using AI coding assistants take 19% longer on tasks and produce 1.7 times more issues, including security vulnerabilities from hallucinated dependencies. Despite believing they’re 20% faster, objective metrics show flat or negative impacts on delivery speed and code quality. So, all that AI hype about boosting productivity? Mostly just a feeling, not a fact, according to multiple studies. <a href="https://app.daily.dev/posts/fLWmEtnzQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Windows 11: the slowest Windows ever?</strong>: Microsoft claims Windows 11 is the “fastest Windows ever,” but a YouTuber’s benchmarks on a Lenovo ThinkPad X220 show it’s the slowest in boot times, app launches, and video editing compared to the last 25 years of Windows versions. It also has the highest idle RAM usage. Apparently, all those background services and AI features are really earning their keep by slowing everything down. Who needs speed when you have ‘innovation’? <a href="https://app.daily.dev/posts/pN49SBVqk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI and Handshake AI want your old work files for training</strong>: OpenAI and Handshake AI are asking contractors to upload past work files (Word docs, PDFs, spreadsheets) for AI training, with a ChatGPT-powered tool supposedly scrubbing sensitive data. Contractors are on the hook for ensuring no proprietary or PII leaks. An unnamed IP lawyer is already raising red flags about this brilliant plan. What could go wrong when you outsource critical data security to a chatbot and a bunch of contractors? <a href="https://app.daily.dev/posts/z0P3L9stb" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
