<h2>Must know</h2>
<ul>
<li><strong>MongoDB vulnerability exposes sensitive data</strong>: A critical vulnerability, CVE-2025-14847 (MongoBleed), in MongoDB allows unauthenticated attackers to read sensitive data from heap memory due to improper handling of zlib-compressed traffic. All MongoDB versions since 2017 are affected, with active exploitation reported and an estimated 87,000 servers potentially exposed. While MongoDB Atlas instances are patched, self-hosted deployments require immediate manual updates, as highlighted by security researchers. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s ChatGPT health raises privacy alarms</strong>: OpenAI is launching ChatGPT Health in beta, allowing users to integrate medical records for personalized insights, partnering with b.well Connected Health. However, the service is unavailable in the EU/UK due to privacy laws and is likely not HIPAA-covered, raising significant concerns about user data commoditization. Financial analyses suggest OpenAI’s aggressive monetization strategy for this venture, as reported by various news outlets and privacy advocates. <a href="https://app.daily.dev/feed-by-ids?id=0lod4TIIq&amp;id=FGI4Oyps1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform hit by critical IDOR vulnerabilities</strong>: Two critical IDOR vulnerabilities, CVE-2026-22589 and CVE-2026-22588, have been discovered in the Spree e-commerce platform. The first allows unauthenticated attackers to access guest user PII, while the second enables authenticated users to access other users’ address data. Patches are available in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5+, with headless API implementations remaining unaffected, according to vulnerability disclosures. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>KDE Plasma 6.6 enhances secret service and themes</strong>: KDE Plasma 6.6 introduces oo7 Secret Service Provider support and the ability to save custom configurations as new global themes, continuing its development trajectory. <a href="https://app.daily.dev/posts/56fNy9wW1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel 7.0 improves Rust and LTO builds</strong>: Linux kernel 7.0 is set to include improvements for building with Rust and Link-Time Optimization (LTO), enhancing performance and code generation for Rust components. <a href="https://app.daily.dev/posts/eeFdKxuyc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Visual Studio Code adds experimental agent skills</strong>: Visual Studio Code 1.108 introduces ‘Agent Skills’ as an experimental feature, allowing developers to extend GitHub Copilot’s capabilities with custom instructions and resources. <a href="https://app.daily.dev/posts/xn90KJxf1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Shakapacker vulnerability leaks environment variables</strong>: Shakapacker versions before 9.5.0 exposed sensitive environment variables to client-side bundles, a critical vulnerability now fixed by an allowlist approach. <a href="https://app.daily.dev/posts/HJUbnChrN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android Open Source Project shifts release schedule</strong>: The Android Open Source Project (AOSP) will transition to a biannual source code release schedule in 2026, publishing in Q2 and Q4 to align with trunk stable development cycles. <a href="https://app.daily.dev/posts/KKcZfdOWG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open source ecosystem sees acquisitions and security updates</strong>: Postman acquired Fern to enhance API documentation, React Router disclosed six security vulnerabilities, and Google established a Bluesky presence for open source engagement. <a href="https://app.daily.dev/feed-by-ids?id=WwNdGJMJK&amp;id=ft8sQFPsm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Raspberry Pi 5 gaming with RTX 5090: not quite there yet</strong>: An experiment showed that while a Raspberry Pi 5 can run older games with an RTX 5090, modern titles remain unplayable due to x86 emulation overhead, achieving only 15 FPS in Cyberpunk 2077. <a href="https://app.daily.dev/posts/41amF20BK" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic burns developer trust with token restrictions</strong>: Anthropic decided to restrict Claude Code subscription tokens from third-party tools, forcing developers into their official harness. This move, as noted by Theo from <a href="http://t3.gg" target="_blank" rel="noopener nofollow">t3.gg</a>, breaks existing workflows and is seen as anti-competitive, especially since OpenAI responded by officially supporting Open Code integration. Apparently, ‘open’ AI means ‘open, but only on our terms.’ <a href="https://app.daily.dev/posts/PQFa1I0wt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flock Safety’s surveillance infrastructure: password ‘security’ at its finest</strong>: A security researcher found Flock Safety hardcoded its ArcGIS API key across 53 public JavaScript bundles, giving unrestricted access to mapping infrastructure with surveillance data from 12,000 deployments. This ‘oversight’ exposed license plate detections, drone telemetry, and 911 call data. It’s almost as if ‘security by obscurity’ was their actual strategy, and it worked about as well as expected. <a href="https://app.daily.dev/posts/rFxdWrNGg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI kills Tailwind’s business model, but not its popularity</strong>: Tailwind CSS is facing a business crisis with 75% staff layoffs and an 80% revenue decline, despite growing popularity. The company blames AI for reducing documentation traffic by 40%, which was their monetization path. So, AI drives adoption but starves the creators—a truly innovative business model for open source, where the ‘free’ part now extends to ‘free from revenue.’ <a href="https://app.daily.dev/posts/f3fYMXUJZ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
