<h2>Must know</h2>
<ul>
<li><strong>Critical MongoDB vulnerability exposes heap memory</strong>: A critical vulnerability, CVE-2025-14847 dubbed “MongoBleed,” in MongoDB allows unauthenticated remote attackers to read sensitive data from heap memory due to improper handling of zlib-compressed network traffic. All MongoDB versions since 2017 are affected, with active exploitation reported in the wild. While MongoDB Atlas instances are patched, self-hosted deployments require immediate updates to prevent data exposure. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Shakapacker and React Router vulnerabilities demand immediate updates</strong>: Shakapacker, a JavaScript bundler for Rails, had a critical vulnerability since 2017 that exposed environment variables, including secrets, to client-side JavaScript. This is fixed in version 9.5.0, but all exposed credentials must be rotated. Additionally, React Router and Remix 2 have six new vulnerabilities, including one critical, urging users to update immediately to the latest versions to prevent credential or sensitive data exposure. <a href="https://app.daily.dev/feed-by-ids?id=HJUbnChrN&amp;id=WwNdGJMJK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel 7.0 advances Rust and LTO integration</strong>: The upcoming Linux kernel 7.0 is set to significantly improve support for Rust and Link-Time Optimization (LTO). Google engineer Alice Ryhl is leading efforts to enhance the integration of C helper functions within Rust code during LTO builds, aiming for better performance and code generation for Rust components in the kernel. This will allow Rust-written modules to interface more tightly with existing C infrastructure, as reported by Phoronix. <a href="https://app.daily.dev/posts/eeFdKxuyc" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Bun shows impressive performance in microservice benchmarks</strong>: Bun, a JavaScript runtime built with Zig and JavaScriptCore, ranks 4th overall in microservice framework performance, outperforming Node.js/Express.js by a factor of 5 in response time and achieving 10x more successful requests per second. <a href="https://app.daily.dev/feed-by-ids?id=MJU0O3aRy&amp;id=TXlo2QmbL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Debian 12.13 and 13.3 point releases address security and stability</strong>: Debian released point releases 12.13 and 13.3, addressing numerous security vulnerabilities and bug fixes in critical components like Apache, Git, PostgreSQL, and the Linux kernel, with updates for Intel microcode and NVIDIA drivers. <a href="https://app.daily.dev/posts/C9n67910v" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Dell’s GB10 superchip targets edge AI with unified memory</strong>: Dell’s GB10 device, featuring Nvidia’s Blackwell GB10 superchip, combines a Grace ARM CPU and Blackwell-class GPU with 128GB unified memory, designed for running large language models and local video analytics at the edge without cloud reliance. <a href="https://app.daily.dev/posts/ow6tBWhoH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform vulnerable to address data exposure</strong>: Two critical vulnerabilities (CVE-2026-22589 and CVE-2026-22588) in the Spree open-source e-commerce platform allow unauthenticated attackers to access guest user address information and authenticated API users to access other users’ addresses, due to insufficient object-level authorization. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ollama 0.14-rc2 enables LLMs to execute bash commands</strong>: Ollama 0.14-rc2 introduces an experimental mode allowing LLMs to execute bash commands and perform web searches on user systems with interactive approval, alongside experimental image generation via the Z-Image model. <a href="https://app.daily.dev/feed-by-ids?id=Sb7YSA4iI&amp;id=b5gNbsldC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kilo open-source coding agent platform expands developer tools</strong>: Kilo is a new open-source coding agent platform integrating with major IDEs, offering cloud agent operation, automated code review, codebase deployment, and parallel execution of AI coding agents with a pay-as-you-go model for over 500 AI models. <a href="https://app.daily.dev/posts/t9TmWNeD6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android Open Source Project adjusts release cadence</strong>: Starting in 2026, the Android Open Source Project (AOSP) will release source code twice annually, in Q2 and Q4, to align with trunk stable development cycles, directing developers to use the <code>android-latest-release</code> manifest branch for contributions. <a href="https://app.daily.dev/posts/KKcZfdOWG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding assistants make you slower, but you’ll feel faster</strong>: Turns out, those AI coding assistants you’re so excited about actually make developers 19% slower and introduce 1.7 times more issues, according to ‘multiple studies.’ But hey, you <em>feel</em> 20% faster, and that’s what really counts, right? Who needs actual productivity when you have the illusion of it, especially when it means less refactoring and more hallucinated dependencies, as the article subtly points out. <a href="https://app.daily.dev/posts/fLWmEtnzQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI and Handshake AI want your old work files for ‘training’</strong>: OpenAI and Handshake AI are reportedly asking contractors to upload their past work files—Word docs, PDFs, spreadsheets—for AI training. They’ve even provided a ChatGPT-powered scrubbing tool to remove sensitive info, but the responsibility for not leaking client data falls squarely on the contractors. Because, clearly, a large language model is the most reliable way to ensure legal compliance and data privacy, as an unnamed IP lawyer wisely suggests. <a href="https://app.daily.dev/posts/z0P3L9stb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Windows 11: the slowest ‘fastest Windows ever’</strong>: Microsoft claims Windows 11 is the ‘fastest Windows ever,’ but a YouTuber’s benchmarks on a Lenovo ThinkPad X220 show it’s actually the slowest in boot times, app launches, and video editing compared to the last 25 years of Windows. Apparently, all those ‘AI-integrated features’ and background services are really helping with performance. Who needs speed when you have more bloat, right? <a href="https://app.daily.dev/posts/pN49SBVqk" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
