<h2>Must know</h2>
<ul>
<li><strong>MongoDB vulnerability exposes sensitive data</strong>: A critical vulnerability, CVE-2025-14847 (MongoBleed), in MongoDB allows unauthenticated attackers to read sensitive data from heap memory due to improper handling of zlib-compressed traffic. All MongoDB versions since 2017 are affected, with security researchers confirming active exploitation and estimating 87,000 servers potentially exposed. While MongoDB Atlas instances are patched, self-hosted deployments require immediate manual updates, as reported by security research disclosures. <a href="https://app.daily.dev/posts/FYcryJBfH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s ChatGPT health raises privacy concerns</strong>: OpenAI has launched ChatGPT Health in beta, allowing users to integrate medical records for personalized insights, partnering with b.well Connected Health. However, privacy experts are raising red flags, noting the service is likely not HIPAA-covered and could commoditize user data for healthcare and insurance companies. The service is unavailable in the EU/UK due to privacy law constraints, highlighting significant regulatory and ethical challenges, as detailed in various reports. <a href="https://app.daily.dev/feed-by-ids?id=0lod4TIIq&amp;id=FGI4Oyps1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spree e-commerce platform hit by critical IDOR vulnerabilities</strong>: Two critical IDOR vulnerabilities, CVE-2026-22589 and CVE-2026-22588, have been discovered in the Spree e-commerce platform. The first allows unauthenticated attackers to access guest user PII, including names and addresses, while the second enables authenticated users to access other users’ address data. Patches are available in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5+, and immediate updates are recommended for affected deployments. <a href="https://app.daily.dev/feed-by-ids?id=OLsziBWC5&amp;id=clMuODSiY" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Visual Studio Code introduces agent skills for Copilot</strong>: Visual Studio Code 1.108 brings an experimental ‘Agent Skills’ feature, allowing developers to extend GitHub Copilot’s capabilities with custom instructions and resources, enhancing personalization and functionality. <a href="https://app.daily.dev/posts/xn90KJxf1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ollama 0.14 lets LLMs run bash commands</strong>: Ollama 0.14-rc2 introduces an experimental agent loop mode, enabling LLMs to execute bash commands and perform web searches on your system with interactive user approval and built-in safety mechanisms. <a href="https://app.daily.dev/posts/b5gNbsldC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Drupal 11.3.0 boosts performance and adds HTMX support</strong>: Drupal 11.3.0 delivers a significant performance boost, serving 26-33% more requests, and introduces native HTMX support to reduce JavaScript weight and enhance user experiences. <a href="https://app.daily.dev/posts/qoxLrj7Wb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android Open Source Project changes release schedule</strong>: The Android Open Source Project (AOSP) will shift to a biannual source code release schedule starting in 2026, with releases in Q2 and Q4, aligning with trunk stable development cycles. <a href="https://app.daily.dev/posts/KKcZfdOWG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flock Safety hardcoded passwords for surveillance infrastructure</strong>: A security researcher found Flock Safety hardcoded its ArcGIS API key across 53 public JavaScript bundles, providing unrestricted access to mapping infrastructure containing surveillance data from thousands of law enforcement deployments. <a href="https://app.daily.dev/posts/rFxdWrNGg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SQL injection vulnerability affects 100+ Indian institutions</strong>: A critical SQL injection vulnerability (CVE-2025-14598, CVSS 9.8) was discovered in a college web portal, affecting over 100 educational institutions in India and exposing data for more than 1 million students. <a href="https://app.daily.dev/posts/kIgpOLq97" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel 7.0 improves Rust and LTO builds</strong>: Linux kernel 7.0 is set to include improvements for building kernels with Rust and Link-Time Optimization (LTO), aiming to enhance performance and code generation for Rust components. <a href="https://app.daily.dev/posts/eeFdKxuyc" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-driven leadership: eliminating enterprise blind spots, or just adding more buzzwords?</strong>: Apparently, ‘Zero Blind Spots’ is the new holy grail for AI-driven leadership, promising clarity, control, and confidence by unifying data and using AI for governance. Because, you know, before AI, nobody ever thought about connecting systems or making data-driven decisions. This sounds less like innovation and more like a fancy rebrand of basic data management, with a generous sprinkle of AI magic to justify massive investments, as SD Times reports. <a href="https://app.daily.dev/posts/e5AzKAHfp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Learning C++ in 2026 is a mistake, says expert. Shocking!</strong>: Stefan Mischook, a developer, boldly claims that learning C++ in 2026 is a ‘mistake’ due to its time investment and manual memory management. Because, clearly, no one needs high-performance systems or low-level control anymore. It’s almost as if different languages serve different purposes, but why bother with nuance when you can just declare a whole language ‘a mistake’? <a href="https://app.daily.dev/posts/trj7gVKm4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Agentic AI: the new buzzword for cloud security</strong>: Non-Human Identities (NHIs) are apparently ‘critical’ for cloud security, and ‘Agentic AI’ is here to save the day with predictive analytics and intelligent security frameworks. It’s a lot of fancy words to describe what sounds like automated credential management and monitoring, but hey, if adding ‘Agentic AI’ makes it sound more cutting-edge and justifies another security product, who are we to argue? <a href="https://app.daily.dev/feed-by-ids?id=8oZN72CkV&amp;id=BV9gFLIe6&amp;id=RXhF8YjoA" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
