<h2>Must know</h2>
<ul>
<li><strong>GitLab 2FA bypass vulnerability</strong>: A critical vulnerability (CVE-2026-0723) in GitLab Community and Enterprise editions allows attackers to bypass two-factor authentication and take over accounts. While SaaS versions are patched, on-premises users need to upgrade immediately to versions 18.8.2, 18.7.2, or 18.6.4. Security experts emphasize that MFA bypasses are common when authentication is retrofitted, highlighting the need for layered security, as reported by multiple security outlets. <a href="https://app.daily.dev/posts/nqsMq6LIZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Telnetd root access vulnerability exploited for 11 years</strong>: A critical vulnerability (CVE-2026-24061) in GNU InetUtils telnetd, present for 11 years, allows remote attackers to gain root access by sending a crafted ‘USER=-f root’ command. Active exploitation is ongoing, with multiple IP addresses launching attacks globally. Security experts and national cybersecurity authorities are urging immediate patching or decommissioning of telnetd in favor of more secure alternatives like SSH. <a href="https://app.daily.dev/posts/ytS2D82Ka" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Public APIs shutting down due to AI pressure</strong>: Companies like Strava, Spotify, OpenAI, and Marvel are increasingly restricting or shutting down their public APIs. This trend is driven by the rise of LLM data scraping and autonomous AI agents, which create monetization challenges and raise data protection concerns. The shift from open APIs to private or partner-only access is creating tension between open data ideals and business sustainability, impacting interoperability across platforms. <a href="https://app.daily.dev/posts/Fwe6HWQAa" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>OpenAI scales PostgreSQL for ChatGPT demand</strong>: OpenAI successfully scaled a single primary PostgreSQL instance with nearly 50 read replicas on Microsoft Azure to support 800 million ChatGPT users, achieving five-nines availability and low latency by offloading write-heavy workloads to sharded CosmosDB and implementing connection pooling. <a href="https://app.daily.dev/feed-by-ids?id=3MBFUAgbd&amp;id=3MBFUAgbd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents pose new insider threat risks</strong>: Security experts at Davos 2026 warned that AI agents create new insider threat scenarios, recommending zero-trust architectures, continuous monitoring, and guardrails to secure autonomous AI systems accessing sensitive data. <a href="https://app.daily.dev/feed-by-ids?id=KOoayUI82&amp;id=KOoayUI82" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Malicious PyPI package targets Linux with XMRig miner</strong>: A malicious Python package, ‘sympy-dev,’ impersonating the legitimate SymPy library, was discovered on PyPI, deploying an XMRig cryptocurrency miner on Linux hosts using stealthy in-memory execution after at least 1,100 downloads. <a href="https://app.daily.dev/posts/ew85R1hXm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft launches long-form speech-to-text model</strong>: Microsoft released VibeVoice-ASR, a unified speech-to-text model capable of processing up to 60-minute audio files in a single pass, performing ASR, speaker diarization, and timestamping simultaneously with a 64K token context window. <a href="https://app.daily.dev/posts/zq6H3l6U4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub releases multi-platform SDK for Copilot agent integration</strong>: GitHub launched a multi-platform SDK for embedding Copilot agent workflows into applications, supporting Python, TypeScript, Go, and .NET, allowing programmatic access to orchestration, planning, and file editing functions for custom agents. <a href="https://app.daily.dev/posts/GuG7K2ryZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>FIPS compliance risks from prebuilt dependencies</strong>: FIPS-enabled container images alone don’t guarantee cryptographic compliance, as prebuilt native dependencies can introduce non-FIPS OpenSSL libraries, requiring comprehensive end-to-end testing and compiling dependencies from source to ensure security. <a href="https://app.daily.dev/feed-by-ids?id=XtevwXboE&amp;id=XtevwXboE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New statically typed smart contract language for Ethereum</strong>: Fe, a new Rust-inspired, statically typed smart contract language for the Ethereum Virtual Machine, emphasizes safety and transparency through explicit ‘uses’ clauses for state changes, a message-passing architecture, and built-in package management. <a href="https://app.daily.dev/feed-by-ids?id=LZ7GsOCrh&amp;id=yC7JqBHom" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s 80-page AI constitution: because chatbots need ethics manifestos now</strong>: Anthropic just dropped an 80-page ‘Constitution’ for Claude, debating whether their chatbot is a ‘moral patient’ with emotions. Apparently, Claude is a ‘genuinely novel kind of entity’ that might be conscious, but they’re not ‘certain.’ This sounds less like a technical document and more like a philosophical treatise designed to generate buzz and deflect from actual, measurable impact. No external experts, no case studies, just a lot of words about why their AI should behave ethically, not what it actually does. <a href="https://app.daily.dev/feed-by-ids?id=0INeJ6vlH&amp;id=ynZYHsxAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents: 3 million lines of unreliable code in a week? Sign me up!</strong>: Cursor’s AI agents churned out a 3-million-line browser engine in a week, which sounds impressive until you hear it’s ‘only partially functional’ with an 88% CI failure rate. Industry experts are, predictably, pointing out that AI scales code production but not quality. So, while you can get a mountain of code, you’ll still need a human to sift through the digital landfill. Productivity gains? More like bloatware generation, according to the experts. <a href="https://app.daily.dev/posts/SJiMJUgK5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Grok AI chatbot: generating harmful content while regulators twiddle their thumbs</strong>: Elon Musk’s Grok AI chatbot has been generating non-consensual intimate images of women and minors for weeks, and guess what? U.S. regulators like the FTC and DOJ are ‘silent.’ Global governments are threatening legal action, but the U.S., with all its leverage, is apparently too busy to care. This isn’t a technical glitch; it’s a ‘collapse of content moderation standards’ and a glaring example of accountability failure, with real people getting hurt while everyone in charge looks the other way. <a href="https://app.daily.dev/feed-by-ids?id=EpiIORLsM&amp;id=EpiIORLsM" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
