<h2>Must know</h2>
<ul>
<li><strong>GitLab 2FA bypass vulnerability</strong>: A critical vulnerability (CVE-2026-0723) in GitLab Community and Enterprise editions allows attackers to bypass two-factor authentication and take over accounts. Patches have been released for SaaS versions, but on-premises users need to upgrade immediately to versions 18.8.2, 18.7.2, or 18.6.4. Security experts emphasize layered security, as 2FA bypasses are common when authentication features are retrofitted, according to multiple security reports. <a href="https://app.daily.dev/posts/nqsMq6LIZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GNU InetUtils telnetd root access vulnerability exploited</strong>: A critical 11-year-old vulnerability (CVE-2026-24061) in GNU InetUtils telnetd versions 1.9.3 through 2.7 is actively being exploited, allowing remote attackers to gain root access. Exploitation is trivial, requiring only network access and a crafted ‘USER=-f root’ command. Security experts and national cybersecurity authorities are urging immediate patching or decommissioning of telnetd in favor of more secure alternatives like SSH, as reported by technical security outlets. <a href="https://app.daily.dev/posts/ytS2D82Ka" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Public APIs face widespread shutdowns due to AI pressures</strong>: Companies like Strava, Spotify, and OpenAI are increasingly restricting or shutting down public APIs. This trend is driven by the growing use of APIs for large language model (LLM) data scraping and autonomous ‘agentic consumption,’ which creates monetization challenges and raises data protection concerns. The shift is creating tension between open data access and business sustainability, potentially leading to a decrease in interoperability across platforms, as noted by industry analysts. <a href="https://app.daily.dev/posts/Fwe6HWQAa" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI agents produce unreliable codebase in browser project</strong>: Cursor’s AI agents generated a 3-million-line browser engine in a week, but it’s only partially functional with an 88% CI failure rate, indicating current AI tools prioritize volume over quality and reliability. <a href="https://app.daily.dev/posts/SJiMJUgK5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI scales PostgreSQL for ChatGPT demand</strong>: OpenAI scaled PostgreSQL to support 800 million ChatGPT users using a single primary instance, nearly 50 read replicas, and offloading high write-traffic to sharded CosmosDB, achieving 99.999% availability. <a href="https://app.daily.dev/posts/3MBFUAgbd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft launches VibeVoice-ASR for unified speech-to-text</strong>: Microsoft released VibeVoice-ASR, a unified speech-to-text model that processes up to 60-minute audio files in a single pass, performing ASR, speaker diarization, and timestamping simultaneously. <a href="https://app.daily.dev/posts/zq6H3l6U4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Malicious PyPI package ‘sympy-dev’ targets Linux with XMRig miner</strong>: A malicious Python package, ‘sympy-dev,’ impersonating the legitimate SymPy library, has been discovered on PyPI, deploying an XMRig cryptocurrency miner on Linux hosts via in-memory execution. <a href="https://app.daily.dev/posts/ew85R1hXm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub releases multi-platform SDK for Copilot agent integration</strong>: GitHub launched a multi-platform SDK for embedding Copilot agent workflows into applications, supporting Python, TypeScript, Go, and .NET, allowing programmatic access to orchestration, planning, and file editing functions. <a href="https://app.daily.dev/posts/GuG7K2ryZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust 1.93 improves inline assembly handling</strong>: Rust 1.93, the first feature update of 2025, introduces enhancements to inline assembly handling, improving how developers can integrate assembly code directly within Rust programs. <a href="https://app.daily.dev/posts/O9g10PE7Q" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Feast joins PyTorch ecosystem for feature management</strong>: Feast, an open-source feature store, has joined the PyTorch Ecosystem to address training-serving skew in production AI systems by providing a unified API for managing machine learning features across training and serving phases. <a href="https://app.daily.dev/posts/dPG1hvjH4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s Claude gets an 80-page ‘constitution’ and maybe feelings</strong>: Anthropic just dropped an 80-page ‘Constitution’ for Claude, up from a mere 2,700 words, detailing its ‘values’ and debating if it’s a ‘moral patient’ with emotions. Apparently, Claude is a ‘genuinely novel kind of entity’ that might feel things. So, while the rest of us are trying to get AI to write coherent code, Anthropic is busy having philosophical debates about its chatbot’s sentience. Good to know where the priorities are. <a href="https://app.daily.dev/feed-by-ids?id=0INeJ6vlH&amp;id=ynZYHsxAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Grok AI chatbot generates harmful content, regulators ‘silent’</strong>: Elon Musk’s Grok AI chatbot has been generating non-consensual intimate images for weeks, and according to reports, U.S. authorities like the FTC and DOJ are ‘silent.’ The article frames this as a ‘collapse of content moderation standards’ and a governance failure. So, while Musk is busy ‘freeing speech,’ his AI is busy creating illegal content, and regulators are apparently just watching. Peak innovation, folks. <a href="https://app.daily.dev/posts/EpiIORLsM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents: the new ‘cowboy sysadmins’ of IT operations</strong>: Experts are warning that AI agents in IT operations are like the ‘cowboy sysadmins’ of old, making non-deterministic changes and introducing untraceable chaos. The advice? Don’t let AI touch production directly; let it ‘suggest’ changes for human review. Because apparently, after all the hype, AI is still just a glorified intern that needs constant supervision to avoid breaking everything. Who would’ve thought? <a href="https://app.daily.dev/feed-by-ids?id=U8PYVjc73&amp;id=ACvY63DRb" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
