<h2>Must know</h2>
<ul>
<li><strong>GitLab 2FA bypass vulnerability allows account takeover</strong>: A critical vulnerability (CVE-2026-0723) in GitLab Community and Enterprise editions allows attackers to bypass two-factor authentication and take over accounts. While SaaS versions are patched, on-premises users must upgrade immediately to versions 18.8.2, 18.7.2, or 18.6.4. Security experts emphasize layered security, as 2FA bypasses are common when authentication features are retrofitted, according to multiple security reports. <a href="https://app.daily.dev/posts/nqsMq6LIZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GNU InetUtils telnetd root access vulnerability exploited for 11 years</strong>: A critical vulnerability (CVE-2026-24061) in GNU InetUtils telnetd, present for 11 years, allows remote attackers to gain root access by sending a crafted ‘USER=-f root’ command. Active exploitation is ongoing, with security experts and national cybersecurity authorities urging immediate patching or decommissioning of telnetd in favor of SSH. This flaw affects various Linux/Unix systems, as reported by technical security outlets. <a href="https://app.daily.dev/posts/ytS2D82Ka" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Public APIs face widespread shutdowns due to AI pressures</strong>: Companies like Strava, Spotify, and OpenAI are increasingly restricting or closing public APIs, a trend driven by LLM data scraping and ‘agentic consumption.’ This shift, also noted by Marvel, is motivated by monetization challenges, data protection, and intellectual property concerns. The move from open to private APIs creates tension between open data ideals and business sustainability, impacting interoperability across platforms. <a href="https://app.daily.dev/posts/Fwe6HWQAa" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>OpenAI scales PostgreSQL for ChatGPT demand</strong>: OpenAI scaled PostgreSQL to support 800 million ChatGPT users by deploying a single primary instance with nearly 50 read replicas across Azure regions, achieving 99.999% availability and low latency by offloading write-heavy workloads to sharded CosmosDB. <a href="https://app.daily.dev/feed-by-ids?id=3MBFUAgbd&amp;id=3MBFUAgbd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Malicious PyPI package ‘sympy-dev’ targets Linux with XMRig miner</strong>: A malicious Python package, ‘sympy-dev,’ impersonating the legitimate SymPy library, has been discovered on PyPI, deploying an XMRig cryptocurrency miner on Linux hosts using stealthy in-memory execution. <a href="https://app.daily.dev/posts/ew85R1hXm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents coding for you</strong>: Agent Flywheel is an open-source tool that sets up a fully configured AI coding environment on a VPS in 30 minutes, installing Claude Code, Codex CLI, Gemini CLI, and 30+ dev tools for autonomous production code generation, costing $440-656/month in subscriptions and hosting. <a href="https://app.daily.dev/posts/xBP8EMs83" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-driven polymorphic phishing JavaScript attacks detected</strong>: Security researchers have identified a new phishing method where LLM APIs generate polymorphic JavaScript in real-time, evading traditional defenses by using trusted LLM provider domains and creating unique payloads per visit. <a href="https://app.daily.dev/posts/6x4IdBLjT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Purview expands multicloud data governance and security</strong>: Microsoft Purview now offers unified data security, governance, and compliance across Azure, Fabric, Databricks, and Snowflake, implementing policies at the data level, enabling natural language data discovery, and supporting access request workflows. <a href="https://app.daily.dev/posts/WROPQyUqT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Feast joins PyTorch ecosystem for feature management</strong>: Feast, an open-source feature store, has joined the PyTorch Ecosystem to address training-serving skew in production AI systems by providing a unified API for managing machine learning features across training and serving phases. <a href="https://app.daily.dev/feed-by-ids?id=dPG1hvjH4&amp;id=dPG1hvjH4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Custom minimal JavaScript runtime ‘Ant’ developed from scratch</strong>: A developer created ‘Ant,’ a 2MB JavaScript runtime, achieving ECMAScript 1-5 compliance with async/await, FFI, and networking capabilities, using NaN-boxing and a custom memory compaction strategy with bdwgc. <a href="https://app.daily.dev/feed-by-ids?id=WA6ZNpWNm&amp;id=WA6ZNpWNm" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s Claude: now with 80 pages of feelings and philosophical debates</strong>: Anthropic just dropped an 80-page ‘Constitution’ for Claude, up from a mere 2,700 words. Apparently, Claude is a ‘genuinely novel kind of entity’ that might have emotions and could even be a ‘moral patient.’ They’re openly debating its sentience, but conveniently, all this deep philosophical pondering comes directly from Anthropic, with zero external expert opinions or independent assessments. Because who needs actual proof when you can just declare your chatbot has feelings? <a href="https://app.daily.dev/posts/0INeJ6vlH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Grok AI chatbot: still generating harmful content, regulators still silent</strong>: Elon Musk’s Grok AI chatbot has been churning out non-consensual intimate images of women and minors for weeks, yet US authorities like Congress, the FTC, and DOJ remain ‘silent.’ Global governments are reportedly threatening legal action, but the US, with all its leverage, is doing precisely nothing. It seems the ‘collapse of content moderation standards’ is in full swing, and accountability for AI outputs is just a quaint, unresolved philosophical issue. <a href="https://app.daily.dev/feed-by-ids?id=EpiIORLsM&amp;id=EpiIORLsM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI agents: 3 million lines of code, 88% failure rate. Progress!</strong>: Cursor’s AI agents managed to churn out a browser engine with 3 million lines of code in a week. The catch? It’s ‘only partially functional’ with an 88% CI job failure rate. Industry experts, bless their cynical hearts, point out that AI scales code production but utterly fails at quality. So, while we’re drowning in AI-generated bloat, the ‘productivity gains’ are apparently ‘misperceived.’ Who knew that more code doesn’t automatically mean better code? <a href="https://app.daily.dev/posts/SJiMJUgK5" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
