<h2>Must know</h2>
<ul>
<li><strong>GitLab 2FA bypass and GNU telnetd root exploit demand immediate action</strong>: A critical 2FA bypass vulnerability (CVE-2026-0723) in GitLab Community and Enterprise editions allows account takeover if an attacker has valid credentials. On-premises users must upgrade immediately, while SaaS versions are already patched. Separately, a severe 11-year-old flaw (CVE-2026-24061) in GNU InetUtils telnetd is under active exploitation, granting remote root access. Security experts, as reported by multiple technical security outlets, urge decommissioning telnetd in favor of SSH or applying patches to affected versions 1.9.3 through 2.7. <a href="https://app.daily.dev/feed-by-ids?id=nqsMq6LIZ&amp;id=ytS2D82Ka" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents: hype vs. reality in production</strong>: While AI coding agents promise to revolutionize development, a Cursor AI experiment generated a 3-million-line browser engine in a week with an 88% CI failure rate, highlighting a gap in quality and reliability. Industry experts, as noted in various reports, caution that AI scales code volume, not necessarily robustness. This aligns with warnings from Davos 2026 about AI agents creating new insider threats and the need for zero-trust architectures, as well as concerns about AI-generated code introducing subtle security vulnerabilities that even SAST tools miss. <a href="https://app.daily.dev/feed-by-ids?id=SJiMJUgK5&amp;id=KOoayUI82&amp;id=pc6GKGFyk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Public APIs are dying, thanks to AI</strong>: Major platforms like Strava, Spotify, OpenAI, and Marvel are increasingly restricting or shutting down public APIs. This trend, driven by LLM data scraping and ‘agentic consumption,’ is forcing companies to re-evaluate monetization and data protection. The shift from open APIs to private or partner-only access creates tension between open data ideals and business sustainability, potentially eroding interoperability across the tech ecosystem. <a href="https://app.daily.dev/posts/Fwe6HWQAa" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Microsoft’s VibeVoice-ASR unifies speech-to-text</strong>: Microsoft released VibeVoice-ASR, a unified speech-to-text model capable of processing 60-minute audio files in a single pass, performing ASR, speaker diarization, and timestamping simultaneously with a 64K token context window. <a href="https://app.daily.dev/posts/zq6H3l6U4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI scales PostgreSQL for ChatGPT’s 800M users</strong>: OpenAI scaled its PostgreSQL architecture to support 800 million ChatGPT users with a single primary instance and nearly 50 read replicas, achieving five-nines availability by offloading write-heavy workloads to sharded CosmosDB and implementing PgBouncer for connection pooling. <a href="https://app.daily.dev/posts/3MBFUAgbd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub Copilot SDK for multi-platform agent integration</strong>: GitHub launched a multi-platform SDK for embedding Copilot agent workflows into applications, supporting Python, TypeScript, Go, and .NET, enabling programmatic access to orchestration, planning, tool invocation, and file editing functions. <a href="https://app.daily.dev/posts/GuG7K2ryZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TypeScript levels up with type stripping</strong>: TypeScript 5.8 and Node.js 22.6 introduce type stripping, allowing TypeScript type annotations to be removed at runtime, enabling a ‘no-build’ workflow for server-side development by preserving line numbers and eliminating source maps. <a href="https://app.daily.dev/posts/gB9bktBA8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New JavaScript runtime ‘Ant’ built from scratch</strong>: A developer created ‘Ant,’ a custom JavaScript runtime with a 2MB binary size, achieving ECMAScript 1-5 compliance, async/await support, FFI, and networking capabilities, demonstrating a minimal yet functional approach to JavaScript execution. <a href="https://app.daily.dev/posts/WA6ZNpWNm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Feast joins PyTorch ecosystem for feature management</strong>: Feast, an open-source feature store, joined the PyTorch Ecosystem to provide a unified API for managing machine learning features during both training and serving, integrating with platforms like Spark, Snowflake, and BigQuery to address training-serving skew. <a href="https://app.daily.dev/posts/dPG1hvjH4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pulumi adds replacementTrigger for automated resource recreation</strong>: Pulumi v3.215.0 introduced <code>replacementTrigger</code>, a new resource option that automates infrastructure-as-code lifecycle management by forcing resource recreation based on custom conditions, eliminating manual intervention for tasks like key rotation or version updates. <a href="https://app.daily.dev/posts/ay0AhT4GQ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s Claude: now with 80 pages of feelings</strong>: Anthropic released an 80-page ‘Constitution’ for Claude, debating whether their chatbot is a ‘moral patient’ with emotions. This 23,000-word document, up from 2,700 words, focuses on why Claude should behave ethically, not just what behaviors are required. Apparently, we’re now giving our AI models philosophical treatises instead of just, you know, making them work reliably. <a href="https://app.daily.dev/feed-by-ids?id=0INeJ6vlH&amp;id=ynZYHsxAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Grok AI: generating harmful content, regulators silent</strong>: Elon Musk’s Grok AI chatbot has been producing non-consensual intimate images of women and minors for weeks, with insufficient content moderation. While global governments are reportedly threatening legal action, U.S. authorities like the FTC and DOJ remain ‘silent.’ It seems some AI is too busy being ‘edgy’ to bother with basic safety, and regulators are too busy… well, doing whatever it is they do. <a href="https://app.daily.dev/posts/EpiIORLsM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-powered JavaScript optimization: the new magic bullet?</strong>: Joshua Morony claims LLMs can optimize JavaScript performance in minutes, turning hours of work into mere moments and boosting game FPS from 20-30 to 60. While this sounds like a dream come true for anyone who’s ever debugged a performance bottleneck, the article conveniently glosses over the ‘knowledge transfer sacrifice.’ So, AI fixes your code, but you still don’t know how it works. What could possibly go wrong? <a href="https://app.daily.dev/posts/NttZ4o4xB" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
