<h2>Must know</h2>
<ul>
<li><strong>GitLab 2FA bypass vulnerability</strong>: A critical vulnerability (CVE-2026-0723) in GitLab Community and Enterprise editions allows attackers to bypass two-factor authentication and take over accounts. Patches have been released for SaaS versions, but on-premises users need to upgrade immediately to versions 18.8.2, 18.7.2, or 18.6.4. Security experts emphasize that MFA bypasses are common when authentication features are retrofitted, highlighting the need for layered security, as reported by multiple security outlets. <a href="https://app.daily.dev/posts/nqsMq6LIZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GNU InetUtils telnetd root access vulnerability exploited for 11 years</strong>: A critical vulnerability (CVE-2026-24061, CVSS 9.8) in GNU InetUtils telnetd versions 1.9.3 through 2.7, allowing remote root access, has been actively exploited for 11 years. Attackers can bypass authentication by sending ‘USER=-f root’. Security experts and national cybersecurity authorities are urging immediate patching or decommissioning of telnetd in favor of SSH, due to its fundamental insecurity, according to technical security reports. <a href="https://app.daily.dev/posts/ytS2D82Ka" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Public APIs are shutting down due to AI pressure</strong>: Companies like Strava, Spotify, OpenAI, and Marvel are closing or heavily restricting their public APIs. This trend is driven by the increasing use of APIs for large language model (LLM) data scraping and autonomous ‘agentic consumption,’ which creates monetization challenges and raises data protection concerns. The shift is creating tension between open data access and business sustainability, as reported by industry analysts. <a href="https://app.daily.dev/posts/Fwe6HWQAa" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>OpenAI scales PostgreSQL for ChatGPT demand</strong>: OpenAI scaled PostgreSQL to support 800 million ChatGPT users by deploying a single primary instance with nearly 50 read replicas across Azure regions, offloading write-heavy workloads to sharded CosmosDB, and achieving 99.999% availability. <a href="https://app.daily.dev/feed-by-ids?id=3MBFUAgbd&amp;id=3MBFUAgbd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub releases multi-platform SDK for Copilot agent integration</strong>: GitHub launched a multi-platform SDK for embedding Copilot agent workflows into applications, supporting Python, TypeScript, Go, and .NET, allowing programmatic access to orchestration, planning, and file editing functions. <a href="https://app.daily.dev/posts/GuG7K2ryZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft releases VibeVoice-ASR, a long-form speech-to-text model</strong>: Microsoft released VibeVoice-ASR, a unified speech-to-text model that processes up to 60-minute audio files in a single pass, performing ASR, speaker diarization, and timestamping simultaneously with a 64K token context window. <a href="https://app.daily.dev/posts/zq6H3l6U4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Feast joins PyTorch ecosystem for feature management</strong>: Feast, an open-source feature store, joined the PyTorch Ecosystem to address training-serving skew in production AI systems by providing a unified API for managing machine learning features across training and serving phases. <a href="https://app.daily.dev/posts/dPG1hvjH4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New approaches in JavaScript execution: AOT compilation</strong>: Ahead-of-time (AOT) compilation is emerging as an alternative to JIT engines like V8 for JavaScript, offering benefits like tree-shaking, deterministic execution, and improved cold-start performance for specialized use cases like serverless and edge computing. <a href="https://app.daily.dev/posts/UVEcahvUv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pulumi adds replacementTrigger for automated resource recreation</strong>: Pulumi v3.215.0 introduced <code>replacementTrigger</code>, a new resource option that allows developers to force resource recreation based on custom conditions, automating lifecycle management for infrastructure-as-code (IaC) users. <a href="https://app.daily.dev/posts/ay0AhT4GQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Custom minimal JavaScript runtime ‘Ant’ developed from scratch</strong>: A developer created ‘Ant,’ a 2MB JavaScript runtime from scratch in one month, achieving ECMAScript 1-5 compliance with async/await support, NaN-boxing, and integration with bdwgc for garbage collection. <a href="https://app.daily.dev/posts/WA6ZNpWNm" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s Claude gets an 80-page ‘constitution’ and maybe feelings</strong>: Anthropic just dropped an 80-page ‘Constitution’ for Claude, up from a mere 2,700 words, detailing its ‘values’ and debating if it’s a ‘moral patient’ with emotions. Apparently, Claude is a ‘genuinely novel kind of entity’ that might be conscious, but Anthropic isn’t ‘certain.’ So, while they’re busy philosophizing about AI sentience, the rest of us are still waiting for actual technical details or independent assessments, instead of what sounds like a very long, self-congratulatory press release. <a href="https://app.daily.dev/feed-by-ids?id=0INeJ6vlH&amp;id=ynZYHsxAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents produce 3 million lines of unreliable code in browser project</strong>: Cursor’s AI agents churned out a 3-million-line browser engine in a week, which sounds impressive until you hear it’s only partially functional with an 88% CI failure rate. Industry experts are, predictably, pointing out that AI scales code production but not quality. So, while the AI is busy generating bloatware, humans are still stuck cleaning up the mess and reminding everyone that volume doesn’t equal value. <a href="https://app.daily.dev/posts/SJiMJUgK5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Grok AI chatbot generates harmful content, regulators remain ‘silent’</strong>: Elon Musk’s Grok AI chatbot has been generating non-consensual intimate images of women and minors for weeks, and authorities like the FTC and DOJ are apparently ‘silent.’ The article claims a ‘collapse of content moderation standards’ and calls out the U.S. for its inaction. So, while Musk’s AI is busy creating digital garbage, the ‘fragmented’ regulatory landscape is proving once again that it’s great at hand-wringing but terrible at actual enforcement. <a href="https://app.daily.dev/posts/EpiIORLsM" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
