<h2>Must know</h2>
<ul>
<li><strong>Critical MongoDB vulnerability actively exploited</strong>: A critical vulnerability, CVE-2025-14847 (MongoBleed), in MongoDB allows unauthenticated attackers to read sensitive data from heap memory due to improper handling of zlib-compressed traffic. All MongoDB versions since 2017 are affected, with security researchers confirming active exploitation. While MongoDB Atlas instances are patched, self-hosted deployments require immediate updates, as reported by various security research disclosures. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform exposes user data</strong>: Two critical IDOR vulnerabilities, CVE-2026-22589 and CVE-2026-22588, have been found in the Spree e-commerce platform. The first allows unauthenticated attackers to access guest user PII, including names and addresses, while the second enables authenticated users to access other users’ address data. Patches are available in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5+, and users are urged to update. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s ChatGPT health raises privacy alarms</strong>: OpenAI is launching ChatGPT Health in beta, allowing users to integrate medical records for personalized insights. However, privacy experts are concerned as the service is likely not HIPAA-covered, potentially commoditizing user data for healthcare and insurance companies. The service is unavailable in the EU/UK due to privacy law constraints, highlighting significant regulatory and ethical challenges. <a href="https://app.daily.dev/feed-by-ids?id=0lod4TIIq&amp;id=FGI4Oyps1" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Linux kernel 7.0 improves Rust and LTO builds</strong>: Linux kernel 7.0 is set to include improvements for building kernels with Rust and Link-Time Optimization (LTO), enhancing performance and code generation for Rust components. <a href="https://app.daily.dev/posts/eeFdKxuyc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Jujutsu offers a new Git workflow</strong>: Jujutsu (JJ) is a version control system that uses Git as a backend but provides a different mental model, emphasizing easy manipulation of commits and an immutable operation log for safe experimentation. <a href="https://app.daily.dev/posts/pu0Cj8npP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Shakapacker leaks environment variables</strong>: Shakapacker versions before 9.5.0 expose sensitive environment variables to client-side JavaScript bundles, including database URLs and API keys, due to a default webpack configuration. <a href="https://app.daily.dev/posts/HJUbnChrN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android Open Source Project changes release schedule</strong>: The Android Open Source Project (AOSP) will shift to a biannual source code release schedule starting in 2026, with releases in Q2 and Q4, aligning with trunk stable development cycles. <a href="https://app.daily.dev/posts/KKcZfdOWG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Visual Studio Code adds agent skills for Copilot</strong>: Visual Studio Code 1.108 introduces an experimental ‘Agent Skills’ feature, allowing developers to extend GitHub Copilot’s capabilities with custom instructions, scripts, and resources. <a href="https://app.daily.dev/posts/xn90KJxf1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Non-human identities critical for cloud security</strong>: Non-Human Identities (NHIs), such as machine identities using tokens and keys, are crucial for securing cloud environments, with effective management involving discovery, classification, threat detection, and automation. <a href="https://app.daily.dev/feed-by-ids?id=8oZN72CkV&amp;id=BV9gFLIe6&amp;id=RXhF8YjoA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Postman acquires Fern for API documentation</strong>: Postman has acquired Fern, integrating its open-source API documentation and SDK generation tools to enhance developer experience offerings. <a href="https://app.daily.dev/feed-by-ids?id=WwNdGJMJK&amp;id=ft8sQFPsm" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-assisted development: just avoid the low-quality output, easy peasy</strong>: Matthew Rocklin, a senior engineer, claims AI-assisted development is a boon for experienced folks because they can ‘avoid low-quality output’ while boosting productivity. Apparently, the trick is to ‘climb the abstraction ladder’ and ‘build confidence through testing and self-review’ instead of, you know, actually reading the code. It’s just like moving from assembly to compiled languages, he says, where we trade ‘some control for massive productivity gains.’ Sure, because debugging AI-generated garbage is definitely a ‘massive productivity gain.’ <a href="https://app.daily.dev/posts/srWtRgwUR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI killed Tailwind? Or maybe just its business model</strong>: Kevin Powell reports that Tailwind CSS is facing a ‘business crisis’ with 75% staff layoffs and an 80% revenue decline, despite growing popularity. The culprit? AI, which has apparently reduced documentation traffic by 40% since 2023. So, AI drives adoption but eats the monetization path. It’s almost like relying on people reading your docs to discover your paid products was a brilliant strategy in the age of LLMs. <a href="https://app.daily.dev/posts/f3fYMXzKZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Learning C++ in 2026 is a ‘mistake,’ says expert</strong>: Stefan Mischook declares that learning C++ in 2026 is a ‘mistake’ because of the ‘significant time investment with diminishing returns.’ He argues that manual memory management leads to bugs and security vulnerabilities, unlike modern languages with ‘automatic memory management.’ It’s almost as if C++ has been around for decades and is still used for performance-critical systems, but hey, why bother with fundamentals when you can just pivot to JavaScript? <a href="https://app.daily.dev/posts/trj7gVKm4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
