<h2>Must know</h2>
<ul>
<li><strong>Critical MongoDB vulnerability exposes heap memory</strong>: MongoDB patched a critical vulnerability, CVE-2025-14847, dubbed “MongoBleed,” allowing unauthenticated remote attackers to read sensitive data from heap memory due to improper handling of zlib-compressed network traffic. All MongoDB versions since 2017 are affected, with active exploitation reported in the wild and approximately 87,000 servers potentially exposed, according to security researchers. While MongoDB Atlas instances are already patched, self-hosted deployments require immediate updates. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Shakapacker vulnerability exposed environment variables</strong>: A critical vulnerability in Shakapacker, a JavaScript bundler for Rails, exposed all environment variables, including sensitive secrets like database URLs and API tokens, to public client-side JavaScript bundles since 2017. The issue, resolved in version 9.5.0, now uses an allowlist for exposed variables, requiring developers to rotate all previously exposed credentials immediately after upgrading, as reported by RUBYLAND. <a href="https://app.daily.dev/feed-by-ids?id=HJUbnChrN&amp;id=WwNdGJMJK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform leaks user address data</strong>: Two critical vulnerabilities (CVE-2026-22589 and CVE-2026-22588) in the open-source Spree e-commerce platform allow attackers to access and manipulate user address information due to insufficient object-level authorization. These flaws could lead to large-scale compromise of customer data, affecting versions prior to 4.10.2, 5.0.7, 5.1.9, and 5.2.5, for which patches are now available. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Bun JavaScript runtime shows impressive performance</strong>: Benchmarks indicate Bun, a JavaScript runtime built with Zig and JavaScriptCore, ranks 4th overall in microservice performance, outperforming Node.js/Express.js by a factor of 5 in response time and 10x in successful requests per second. <a href="https://app.daily.dev/feed-by-ids?id=MJU0O3aRy&amp;id=TXlo2QmbL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New TypeScript UI framework Ripple emphasizes simplicity</strong>: Ripple is a compiler-first TypeScript UI framework focusing on simplicity and fine-grained reactivity, using <code>track()</code> and <code>@</code> syntax for state management without hooks or signals, and optimizing for compile-time dead CSS removal and direct DOM updates. <a href="https://app.daily.dev/posts/n7wKczt0h" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel 7.0 advances Rust and LTO integration</strong>: Linux kernel 7.0 is in development with improved support for building kernels using Rust and Link-Time Optimization (LTO), aiming to enhance performance and code generation for Rust components. <a href="https://app.daily.dev/posts/eeFdKxuyc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Debian releases security and stability updates</strong>: Debian released 12.13 and 13.3 point releases, addressing numerous security vulnerabilities and bug fixes in critical components like Apache, Git, PostgreSQL, and the Linux kernel, with updates for Intel microcode and NVIDIA drivers. <a href="https://app.daily.dev/posts/C9n67910v" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open-source coding agent platform Kilo launched</strong>: Kilo is a new open-source coding agent platform integrating with major IDEs, offering cloud agent operation, automated code review, codebase deployment, and parallel execution of AI coding agents with persistent sessions and transparent pay-as-you-go pricing. <a href="https://app.daily.dev/feed-by-ids?id=ow6tBWhoH&amp;id=t9TmWNeD6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Skills offers free AI and tech courses</strong>: Google Skills is a free learning platform providing over 3,000 courses from top tech companies, focusing on AI, machine learning, and generative AI, with personalized learning paths, hands-on activities, and Google Career Certificates. <a href="https://app.daily.dev/posts/1LfniMfaa" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Multiple h1 elements are bad for accessibility</strong>: While technically valid, using multiple h1 elements on a page is not recommended for user experience and accessibility, as screen reader users primarily navigate by headings and expect a single h1 to describe the page’s main content. <a href="https://app.daily.dev/posts/wFkZ8Qebn" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding assistants make you slower, but you’ll feel faster</strong>: Turns out, developers using AI coding assistants take 19% longer on tasks and produce 1.7 times more issues, yet they <em>believe</em> they’re 20% faster. Apparently, the illusion of productivity from less typing and more activity trumps actual performance and code quality. So, we’re just amplifying bad habits with a fancy AI wrapper, making us feel good while our codebases slowly rot. <a href="https://app.daily.dev/posts/fLWmEtnzQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI and Handshake AI want your old work files for training, trust you to scrub them</strong>: OpenAI and Handshake AI are reportedly asking contractors to upload past work files—Word docs, PDFs, spreadsheets—for AI training, with the expectation that contractors will use a ChatGPT-powered tool to remove all proprietary and personal info. An unnamed IP lawyer is already raising red flags about the legal risks of entrusting this critical task to individuals. What could possibly go wrong when you outsource sensitive data scrubbing to the very people whose data you’re trying to protect, using a tool from the company that wants the data? <a href="https://app.daily.dev/posts/z0P3L9stb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Windows 11: the slowest Windows in 25 years, according to one YouTuber</strong>: A YouTuber benchmarked Windows XP through 11 on an old ThinkPad and declared Windows 11 the slowest in boot times and app launches, directly contradicting Microsoft’s ‘fastest Windows ever’ claims. Apparently, all those background services and ‘AI-integrated features’ are doing wonders for performance. Who needs speed when you have… more stuff running in the background? <a href="https://app.daily.dev/posts/pN49SBVqk" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
