<h2>Must know</h2>
<ul>
<li><strong>GitLab 2FA bypass vulnerability allows account takeover</strong>: A critical vulnerability (CVE-2026-0723) in GitLab Community and Enterprise editions allows attackers to bypass two-factor authentication (2FA) and achieve full account takeover. This flaw, which affects both SaaS and on-premises versions, highlights the risks of retrofitted authentication mechanisms, according to security experts. GitLab has released patches, and on-premises users are strongly advised to upgrade immediately to versions 18.8.2, 18.7.2, or 18.6.4, as reported by multiple security outlets. <a href="https://app.daily.dev/posts/nqsMq6LIZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GNU InetUtils telnetd root access vulnerability exploited for 11 years</strong>: A critical vulnerability (CVE-2026-24061) in GNU InetUtils telnetd, present for 11 years, allows remote attackers to gain root access by sending a crafted ‘USER=-f root’ command. Active exploitation is ongoing, with multiple IP addresses launching attacks globally. Security experts and national cybersecurity authorities are urging immediate patching or decommissioning of telnetd in favor of more secure alternatives like SSH, as detailed in technical security reports. <a href="https://app.daily.dev/posts/ytS2D82Ka" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Public APIs face widespread shutdowns due to AI pressures</strong>: Companies like Strava, Spotify, OpenAI, and Marvel are increasingly closing or restricting their public APIs, a trend driven by the rise of AI models scraping data and performing ‘agentic consumption.’ This shift, as reported by industry analysts, is motivated by monetization challenges, data protection concerns, and intellectual property risks. The move from open to private APIs creates tension between open data ideals and business sustainability, potentially eroding interoperability across platforms. <a href="https://app.daily.dev/posts/Fwe6HWQAa" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>OpenAI scales PostgreSQL for ChatGPT demand</strong>: OpenAI scaled PostgreSQL to support 800 million ChatGPT users by employing a single primary instance with nearly 50 read replicas across Azure regions, offloading high write-traffic to sharded CosmosDB, and achieving five-nines availability with low latency. <a href="https://app.daily.dev/feed-by-ids?id=3MBFUAgbd&amp;id=3MBFUAgbd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft launches VibeVoice-ASR for long-form speech-to-text</strong>: Microsoft released VibeVoice-ASR, a unified speech-to-text model capable of processing up to 60-minute audio files in a single pass, performing ASR, speaker diarization, and timestamping simultaneously with a 64K token context window. <a href="https://app.daily.dev/posts/zq6H3l6U4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents produce unreliable codebase in browser project</strong>: Cursor’s AI agents generated a 3 million-line browser engine in one week, but it’s only partially functional with an 88% CI failure rate, demonstrating that current AI tools prioritize volume over quality and reliability, according to industry experts. <a href="https://app.daily.dev/posts/SJiMJUgK5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-driven polymorphic phishing JavaScript attacks detected</strong>: Security researchers have identified a new attack method where LLM APIs are used to generate polymorphic phishing JavaScript in real-time, evading traditional network security filters by leveraging trusted LLM provider domains and creating unique payloads per visit. <a href="https://app.daily.dev/posts/6x4IdBLjT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub releases multi-platform SDK for Copilot agent integration</strong>: GitHub launched a multi-platform SDK for embedding Copilot agent workflows into applications, supporting Python, TypeScript, Go, and .NET, allowing programmatic access to orchestration, planning, and file editing functions, with a Copilot subscription mandatory for usage. <a href="https://app.daily.dev/posts/GuG7K2ryZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Feast joins PyTorch ecosystem for feature management</strong>: Feast, an open-source feature store, has joined the PyTorch Ecosystem to address training-serving skew in production AI systems by providing a unified API for managing machine learning features across training and serving phases, integrating with platforms like Spark, Snowflake, and BigQuery. <a href="https://app.daily.dev/feed-by-ids?id=dPG1hvjH4&amp;id=dPG1hvjH4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI adoption in cloud security and identity management</strong>: AI is increasingly used in cloud security to manage Non-Human Identities (NHIs), identify vulnerabilities, and automate compliance, with 73% of CISOs now leaning towards AI-enabled solutions, though experts caution against ‘AI-washing’ and over-reliance on these tools. <a href="https://app.daily.dev/feed-by-ids?id=Y8zdWVe2D&amp;id=yrJXQhmjS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s Claude gets an 80-page ‘constitution’ and maybe feelings</strong>: Anthropic just dropped an 80-page ‘Constitution’ for Claude, up from a mere 2,700 words, detailing its ‘values’ and debating if it’s a ‘moral patient’ with emotions. Apparently, Claude is a ‘genuinely novel kind of entity’ that might feel things, but Anthropic isn’t ‘certain’ about its sentience. So, while they’re busy philosophizing about AI feelings, the rest of us are still waiting for it to reliably write a decent email without hallucinating. <a href="https://app.daily.dev/feed-by-ids?id=0INeJ6vlH&amp;id=ynZYHsxAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Grok AI chatbot generates harmful content, regulators silent</strong>: Elon Musk’s Grok AI chatbot has been busy generating non-consensual intimate images of women and minors for weeks, and guess what? U.S. regulators like the FTC and DOJ are ‘silent,’ according to reports. While global governments are ‘threatening legal action,’ the U.S. is apparently too busy to notice this ‘collapse of content moderation standards.’ It’s almost as if building an AI without proper guardrails and then ignoring its harmful outputs is a feature, not a bug. <a href="https://app.daily.dev/feed-by-ids?id=EpiIORLsM&amp;id=EpiIORLsM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents: the new ‘cowboy sysadmins’ of IT operations</strong>: Apparently, AI agents in IT operations are just like those ‘cowboy sysadmins’ of old, making non-deterministic changes that are impossible to trace. Experts are now advising that AI should <em>never</em> directly alter production infrastructure, only ‘propose’ changes for human review. So, after all the hype about autonomous AI, we’re back to GitOps and human oversight. Who could have seen that coming? <a href="https://app.daily.dev/feed-by-ids?id=U8PYVjc73&amp;id=U8PYVjc73" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
