<h2>Must know</h2>
<ul>
<li><strong>GitLab 2FA bypass vulnerability</strong>: A critical vulnerability (CVE-2026-0723) in GitLab Community and Enterprise editions allows attackers to bypass two-factor authentication (2FA) and take over accounts. While SaaS versions are patched, on-premises users must upgrade immediately to versions 18.8.2, 18.7.2, or 18.6.4. Security experts emphasize that 2FA bypasses are common when authentication features are retrofitted, highlighting the need for layered security, as reported by multiple security outlets. <a href="https://app.daily.dev/posts/nqsMq6LIZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GNU InetUtils telnetd root access vulnerability exploited</strong>: A critical vulnerability (CVE-2026-24061, CVSS 9.8) in GNU InetUtils telnetd versions 1.9.3 through 2.7 allows remote attackers to gain root access by sending a crafted ‘USER=-f root’ command. This 11-year-old flaw is actively being exploited by numerous IP addresses globally. Security experts and national cybersecurity authorities are urging immediate patching or decommissioning of telnetd in favor of more secure alternatives like SSH, according to technical security reports. <a href="https://app.daily.dev/posts/ytS2D82Ka" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents pose new insider threats and security risks</strong>: Security experts at Davos 2026 warn that AI agents are creating new insider threat scenarios, making it difficult for organizations to secure autonomous systems accessing sensitive data. They recommend zero-trust architectures, continuous monitoring, and guardrails for AI agents, treating them like employees. The challenge lies in training AI to resist social engineering while maintaining utility, with no definitive solutions yet available, as discussed at the Davos panel. <a href="https://app.daily.dev/feed-by-ids?id=KOoayUI82&amp;id=KOoayUI82" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Java ecosystem updates and Spring Boot release</strong>: The Java ecosystem sees updates including Spring AI agentic patterns, Jakarta Persistence 4.0, OpenJDK security patches, and a comprehensive garbage collection guide, alongside the release of Spring Boot 3.5.10. <a href="https://app.daily.dev/feed-by-ids?id=Qrj5OsOmz&amp;id=Nx9NV8uH2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI scales PostgreSQL for ChatGPT demand</strong>: OpenAI scaled PostgreSQL to support 800 million ChatGPT users by deploying nearly 50 read replicas across Azure regions and offloading high write-traffic to sharded CosmosDB, achieving five-nines availability and low double-digit millisecond latencies. <a href="https://app.daily.dev/feed-by-ids?id=3MBFUAgbd&amp;id=3MBFUAgbd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents reshape software development</strong>: AI coding agents are transitioning from passive tools to active collaborators, with 60% of developer work now involving AI, though only 0-20% of tasks can be fully delegated, requiring human supervision for architecture and strategic decisions. <a href="https://app.daily.dev/feed-by-ids?id=SxfRwPJcN&amp;id=SxfRwPJcN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub releases multi-platform SDK for Copilot agent integration</strong>: GitHub launched a multi-platform SDK for embedding Copilot agent workflows into applications, supporting Python, TypeScript, Go, and .NET, allowing programmatic access to orchestration, planning, and file editing functions. <a href="https://app.daily.dev/feed-by-ids?id=GuG7K2ryZ&amp;id=GuG7K2ryZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TypeScript levels up with type stripping</strong>: TypeScript now supports type stripping, an alternative to transpilation that removes type annotations at runtime, enabling a ‘no-build’ workflow for server-side development, with Node.js 22.6 and TypeScript 5.8 offering experimental support. <a href="https://app.daily.dev/posts/gB9bktBA8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New approaches in JavaScript execution: rise of AOT compilation</strong>: Ahead-of-time (AOT) compilation is emerging as an alternative to traditional JIT engines for JavaScript, offering benefits like tree-shaking, deterministic execution, and improved cold-start performance for specialized use cases like serverless and edge computing. <a href="https://app.daily.dev/posts/UVEcahvUv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Feast joins PyTorch ecosystem for feature management</strong>: Feast, an open-source feature store, has joined the PyTorch Ecosystem to address training-serving skew in production AI systems by providing a unified API for managing machine learning features across training and serving phases. <a href="https://app.daily.dev/feed-by-ids?id=dPG1hvjH4&amp;id=dPG1hvjH4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s Claude: now with 80 pages of feelings</strong>: Anthropic just dropped an 80-page ‘Constitution’ for Claude, up from a mere 2,700 words, debating whether their chatbot is a ‘moral patient’ with emotions. They’re not ‘certain’ about sentience, but hey, it’s a ‘genuinely novel kind of entity.’ Apparently, this is how we ensure ethical AI: by writing a novel-length philosophical treatise instead of, you know, actual technical safeguards. No independent assessments, just Anthropic telling us how deep Claude’s thoughts are. <a href="https://app.daily.dev/feed-by-ids?id=0INeJ6vlH&amp;id=ynZYHsxAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding assistants: the free ride is over, the security risks are just beginning</strong>: Grok Code Fast ended its free tier, forcing developers to face the ‘hidden’ costs of AI coding, which apparently range from $100-200/month for heavy users. Meanwhile, Check Point Research found North Korean hackers using AI-generated PowerShell backdoors, and a honeypot experiment showed AI introducing subtle client-supplied IP header vulnerabilities that even SAST tools missed. So, while you’re paying more for your AI assistant, it might just be helping hackers or introducing new security debt. <a href="https://app.daily.dev/feed-by-ids?id=I1I7kR81e&amp;id=wO1HB29Wl&amp;id=pc6GKGFyk&amp;id=pc6GKGFyk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents for white-collar work: still mostly useless, but getting there!</strong>: Mercor’s new Apex-Agents benchmark, designed for ‘real-world white-collar tasks’ like consulting and investment banking, found that top AI models like Gemini 3 Flash and GPT-5.2 achieved a stunning 24% accuracy. The report assures us that knowledge workers aren’t replaceable ‘currently,’ which is a relief, given that these AI agents can’t even reliably switch context or integrate fragmented information. But don’t worry, there’s ‘significant year-over-year improvement,’ so maybe next decade they’ll hit 30%. <a href="https://app.daily.dev/posts/OsmrZ9UpM" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
