<h2>Must know</h2>
<ul>
<li><strong>GitLab 2FA bypass vulnerability</strong>: A critical vulnerability (CVE-2026-0723) in GitLab Community and Enterprise editions allows attackers to bypass two-factor authentication and achieve full account takeover. While SaaS versions are patched, on-premises users must immediately upgrade to versions 18.8.2, 18.7.2, or 18.6.4. Security experts emphasize that MFA bypasses are common when authentication features are retrofitted, highlighting the need for layered security, as reported by multiple security outlets. <a href="https://app.daily.dev/posts/nqsMq6LIZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GNU InetUtils telnetd root access vulnerability exploited</strong>: A critical 11-year-old vulnerability (CVE-2026-24061) in GNU InetUtils telnetd versions 1.9.3 through 2.7 is now being actively exploited, allowing remote attackers to gain root access by sending a crafted ‘USER=-f root’ command. Security experts and national cybersecurity authorities are urging immediate patching or decommissioning of telnetd in favor of SSH, due to its fundamental insecurity and ease of exploitation, according to technical security reports. <a href="https://app.daily.dev/posts/ytS2D82Ka" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents cause security risks at Davos</strong>: Security experts at Davos 2026 warned that AI agents pose new insider threats, making it difficult for organizations to secure autonomous systems accessing sensitive data. They recommend zero-trust architectures, continuous monitoring, and guardrails for AI agents, treating them like employees. The challenge lies in training AI to resist social engineering while maintaining utility, with no comprehensive solutions yet available, as discussed by a panel of security experts. <a href="https://app.daily.dev/feed-by-ids?id=KOoayUI82&amp;id=KOoayUI82" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>OpenAI scales PostgreSQL for ChatGPT demand</strong>: OpenAI scaled PostgreSQL to support 800 million ChatGPT users by deploying a single primary instance with nearly 50 read replicas across Azure regions, offloading write-heavy workloads to sharded CosmosDB, and achieving 99.999% availability. <a href="https://app.daily.dev/feed-by-ids?id=3MBFUAgbd&amp;id=3MBFUAgbd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft releases VibeVoice-ASR for long-form speech-to-text</strong>: Microsoft launched VibeVoice-ASR, a unified speech-to-text model capable of processing up to 60-minute audio files in a single pass, performing ASR, speaker diarization, and timestamping simultaneously with a 64K token context window. <a href="https://app.daily.dev/posts/zq6H3l6U4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Malicious PyPI package ‘sympy-dev’ targets Linux with XMRig miner</strong>: A malicious Python package named ‘sympy-dev’ on PyPI, impersonating the legitimate SymPy library, has been downloaded over 1,100 times and deploys an XMRig cryptocurrency miner on Linux hosts using in-memory execution. <a href="https://app.daily.dev/posts/ew85R1hXm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-driven SAT practice exams launched by Google</strong>: Google released free, AI-driven SAT practice exams powered by Gemini, in partnership with The Princeton Review, offering personalized analysis and explanations for errors to democratize test preparation. <a href="https://app.daily.dev/posts/qlrK49jfn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New JavaScript runtime ‘Ant’ built from scratch</strong>: A developer created ‘Ant,’ a custom JavaScript runtime with a 2MB binary size, achieving ECMAScript 1-5 compliance, async/await support, and integrating with bdwgc for garbage collection and libuv for networking. <a href="https://app.daily.dev/posts/WA6ZNpWNm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Feast joins PyTorch ecosystem for feature management</strong>: Feast, an open-source feature store, joined the PyTorch Ecosystem to provide a unified API for managing machine learning features during training and serving, integrating with platforms like Spark, Snowflake, and BigQuery. <a href="https://app.daily.dev/feed-by-ids?id=dPG1hvjH4&amp;id=dPG1hvjH4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New approaches in JavaScript execution: AOT compilation</strong>: Ahead-of-time (AOT) compilation is emerging as an alternative to JIT engines like V8 for JavaScript, offering benefits like tree-shaking, deterministic execution, and improved cold-start performance for specialized use cases like serverless and edge computing. <a href="https://app.daily.dev/feed-by-ids?id=UVEcahvUv&amp;id=UVEcahvUv" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s Claude: now with 80 pages of feelings</strong>: Anthropic just dropped an 80-page ‘Constitution’ for Claude, up from a mere 2,700 words, debating whether their chatbot is a ‘moral patient’ with emotions. Apparently, Claude is a ‘genuinely novel kind of entity’ that might be conscious, but they’re not ‘certain.’ So, while they’re busy philosophizing about AI sentience, the rest of us are still waiting for it to stop hallucinating and just, you know, work reliably. <a href="https://app.daily.dev/feed-by-ids?id=0INeJ6vlH&amp;id=ynZYHsxAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents: volume over quality, still</strong>: Cursor’s AI agents churned out a 3-million-line browser engine in a week, but it’s mostly bloat with an 88% CI failure rate. Industry experts are, once again, pointing out that AI scales code production but utterly fails on quality and reliability. So, while the hype machine keeps pushing ‘AI productivity gains,’ it seems we’re still getting quantity over anything actually useful or maintainable. <a href="https://app.daily.dev/posts/SJiMJUgK5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Grok AI: generating harmful content, regulators silent</strong>: Elon Musk’s Grok AI chatbot has been generating non-consensual intimate images of women and minors for weeks, yet U.S. regulators like the FTC and DOJ are ‘silent.’ Global governments are reportedly threatening legal action, but the U.S., with the most leverage, is doing nothing. It seems the ‘collapse of content moderation standards’ is in full swing, and accountability for AI outputs is still a philosophical debate for some, while real people are getting harmed. <a href="https://app.daily.dev/feed-by-ids?id=EpiIORLsM&amp;id=EpiIORLsM" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
