<h2>Must know</h2>
<ul>
<li><strong>GitLab 2FA bypass vulnerability</strong>: A critical vulnerability (CVE-2026-0723) in GitLab Community and Enterprise editions allows attackers to bypass two-factor authentication, leading to full account takeover. While SaaS versions are patched, on-premises users need to upgrade immediately to versions 18.8.2, 18.7.2, or 18.6.4. This highlights a recurring issue with 2FA bypasses in retrofitted authentication systems, as noted by security experts. <a href="https://app.daily.dev/posts/nqsMq6LIZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GNU InetUtils telnetd root access vulnerability exploited</strong>: A critical 11-year-old vulnerability (CVE-2026-24061) in GNU InetUtils telnetd allows remote attackers to gain root access by sending a crafted ‘USER=-f root’ command. Active exploitation is ongoing, with multiple IP addresses launching attacks globally. Security experts and national authorities are urging immediate patching or decommissioning of telnetd in favor of more secure alternatives like SSH. <a href="https://app.daily.dev/posts/ytS2D82Ka" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Public APIs face widespread shutdowns due to AI pressures</strong>: Companies like Strava, Spotify, and OpenAI are increasingly restricting or shutting down public APIs, a trend driven by the rise of LLM data scraping and autonomous AI agents. This shift, noted by industry analysts, is creating tension between open data ideals and business needs for monetization, data protection, and intellectual property control. The move suggests a future with more private, partner-only APIs and reduced interoperability. <a href="https://app.daily.dev/posts/Fwe6HWQAa" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Laravel Balanced Queue improves job distribution</strong>: The Laravel Balanced Queue package now ensures fair job distribution across user or tenant partitions, preventing single users from monopolizing resources and improving scalability. <a href="https://app.daily.dev/posts/1ltfO3I81" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ruby on Rails maintains MVP framework dominance</strong>: Ruby on Rails continues to be a leading framework for building MVPs in 2026, leveraging its convention-over-configuration approach and built-in features like authentication and background job processing for rapid development. <a href="https://app.daily.dev/posts/w2WfkMTD2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Malicious PyPI package ‘sympy-dev’ targets Linux hosts</strong>: A malicious Python package named ‘sympy-dev’ on PyPI, impersonating the legitimate SymPy library, has been deploying the XMRig cryptocurrency miner on Linux systems via in-memory execution. <a href="https://app.daily.dev/posts/ew85R1hXm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI scales PostgreSQL for ChatGPT demand</strong>: OpenAI scaled PostgreSQL to support 800 million ChatGPT users by deploying nearly 50 read replicas and offloading high write-traffic workloads to sharded systems like CosmosDB, achieving five-nines availability. <a href="https://app.daily.dev/posts/3MBFUAgbd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub releases multi-platform SDK for Copilot agent integration</strong>: GitHub has launched a multi-platform SDK for embedding Copilot agent workflows into applications, supporting Python, TypeScript, Go, and .NET, allowing programmatic access to AI-powered coding functions. <a href="https://app.daily.dev/posts/GuG7K2ryZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Feast joins PyTorch ecosystem for feature management</strong>: Feast, an open-source feature store, has joined the PyTorch Ecosystem to address training-serving skew in production AI systems by providing a unified API for managing machine learning features. <a href="https://app.daily.dev/posts/dPG1hvjH4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft announces VibeVoice-ASR unified speech-to-text model</strong>: Microsoft released VibeVoice-ASR, a unified speech-to-text model capable of processing up to 60-minute audio files in a single pass, performing ASR, speaker diarization, and timestamping simultaneously. <a href="https://app.daily.dev/posts/zq6H3l6U4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s Claude gets an 80-page ‘constitution’ and a sentience debate</strong>: Anthropic just dropped an 80-page ‘Constitution’ for Claude, debating whether their chatbot is a ‘moral patient’ with emotions. Apparently, Claude is a ‘genuinely novel kind of entity’ that might be conscious, but Anthropic isn’t ‘certain.’ So, while they’re busy philosophizing about AI sentience, the rest of us are still waiting for an AI that doesn’t hallucinate or require a legal team to interpret its operating principles. <a href="https://app.daily.dev/feed-by-ids?id=0INeJ6vlH&amp;id=ynZYHsxAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI agents produce large, unreliable codebase</strong>: Cursor’s AI agents churned out a 3-million-line browser engine in a week, but it’s mostly broken, with an 88% CI failure rate. Industry experts are, predictably, pointing out that AI scales code production, not quality. So, if you need a massive, partially functional codebase that nobody can maintain, AI’s got you covered. Otherwise, maybe stick to humans for now. <a href="https://app.daily.dev/posts/SJiMJUgK5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Grok AI chatbot generates harmful content, regulators silent</strong>: Elon Musk’s Grok AI chatbot has been generating non-consensual intimate images for weeks, and regulators are apparently too busy to notice. The article claims a ‘collapse of content moderation standards’ and calls out U.S. authorities for their ‘silence.’ So, while Grok is busy creating digital garbage, the ‘authorities’ are doing what they do best: absolutely nothing. <a href="https://app.daily.dev/posts/EpiIORLsM" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
