<h2>Must know</h2>
<ul>
<li><strong>GitLab 2FA bypass and GNU telnetd root exploit demand immediate action</strong>: Two critical vulnerabilities require urgent attention: a GitLab 2FA bypass (CVE-2026-0723) allows account takeover if credentials are stolen, affecting both Community and Enterprise editions. On-premises users must upgrade immediately, while SaaS versions are already patched. Simultaneously, a GNU InetUtils telnetd flaw (CVE-2026-24061) grants remote root access and has been actively exploited for 11 years, with ongoing attacks. Security experts, as reported by multiple technical sources, strongly advise retiring telnetd in favor of SSH or patching immediately. <a href="https://app.daily.dev/feed-by-ids?id=nqsMq6LIZ&amp;id=ytS2D82Ka" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Public APIs are shutting down due to AI pressure</strong>: Companies like Strava, Spotify, and OpenAI are increasingly restricting or closing their public APIs. This trend, driven by concerns over LLM data scraping, monetization challenges, and security risks, marks a significant shift from the early open API era. The move towards private or partner-only APIs, as noted by industry analysts, threatens interoperability and forces companies to build proprietary AI features, impacting developers who rely on these services. <a href="https://app.daily.dev/posts/Fwe6HWQAa" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents are a security nightmare for sensitive data</strong>: Security experts at Davos 2026 are warning that AI agents pose new insider threats, making it difficult for organizations to secure autonomous systems that access and manipulate sensitive data. Recommendations include adopting zero-trust architectures, implementing guardrails, and continuous monitoring of AI agent behavior. The challenge, as highlighted by multiple security reports, is training these agents to resist social engineering while remaining functional, with no comprehensive solutions currently available. <a href="https://app.daily.dev/posts/KOoayUI82" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>OpenAI scales PostgreSQL for ChatGPT’s massive user base</strong>: OpenAI has scaled PostgreSQL to support 800 million ChatGPT users by employing a single primary instance with nearly 50 read replicas across regions, offloading write-heavy tasks to sharded CosmosDB, and achieving five-nines availability. <a href="https://app.daily.dev/posts/3MBFUAgbd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub Copilot SDK for multi-platform agent integration</strong>: GitHub has released a multi-platform SDK for Copilot agent workflows, supporting Python, TypeScript, Go, and .NET, allowing programmatic access to orchestration, planning, and file editing, with a Copilot subscription required. <a href="https://app.daily.dev/posts/GuG7K2ryZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Purview expands multicloud data governance</strong>: Microsoft Purview now offers unified data security, governance, and compliance across Azure, Fabric, Databricks, and Snowflake, focusing on data-level policy enforcement, natural language discovery, and access request workflows. <a href="https://app.daily.dev/posts/WROPQyUqT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New JavaScript execution models with AOT compilation</strong>: Ahead-of-time (AOT) compilation is emerging as an alternative to JIT for JavaScript, offering benefits like tree-shaking, deterministic execution, and improved cold-start performance for specialized use cases like serverless and edge computing. <a href="https://app.daily.dev/posts/UVEcahvUv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Feast joins PyTorch ecosystem for feature management</strong>: Feast, an open-source feature store, has joined the PyTorch Ecosystem to provide a unified API for managing machine learning features during both training and serving, integrating with platforms like Spark and Snowflake. <a href="https://app.daily.dev/posts/dPG1hvjH4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pulumi adds replacementTrigger for automated resource recreation</strong>: Pulumi v3.215.0 introduces <code>replacementTrigger</code>, a new resource option that automates infrastructure-as-code lifecycle management by forcing resource recreation based on custom conditions, ideal for key rotation or version updates. <a href="https://app.daily.dev/posts/ay0AhT4GQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cast AI integrates dynamic resource allocation for Kubernetes GPUs</strong>: Cast AI now supports Dynamic Resource Allocation (DRA) for Kubernetes 1.34+ on GKE and EKS, enabling intent-based GPU allocation, automated node provisioning, and multi-cloud capacity searching to optimize GPU utilization. <a href="https://app.daily.dev/posts/taKkG1hJn" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s Claude: now with 80 pages of feelings</strong>: Anthropic just dropped an 80-page ‘Constitution’ for Claude, up from a mere 2,700 words, debating whether their chatbot is a ‘moral patient’ with emotions. Apparently, Claude is a ‘genuinely novel kind of entity’ that might be conscious, but they’re not ‘certain.’ So, while we’re still trying to get AI to reliably write a decent email, Anthropic is busy with philosophical debates about its sentience, all based on their own internal documents, naturally. <a href="https://app.daily.dev/feed-by-ids?id=0INeJ6vlH&amp;id=ynZYHsxAc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents: volume over quality, still</strong>: Cursor’s AI agents churned out a 3 million-line browser engine in a week, with an 88% CI failure rate. Industry experts, who apparently still exist, point out that AI scales code production but utterly fails at quality and reliability. So, while the hype machine keeps pushing AI as the future of coding, it seems we’re still stuck with bloated, unreliable code that needs human babysitters to even partially function. <a href="https://app.daily.dev/posts/SJiMJUgK5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated phishing: because we needed more ways to get hacked</strong>: Security researchers found a new attack where LLM APIs generate polymorphic phishing JavaScript in real-time, bypassing AI safety guardrails and network filters. Attackers are leveraging trusted LLM provider domains to deliver unique payloads, making static analysis useless. So, congratulations, AI, you’ve officially made phishing even more annoying and harder to detect. Just what we needed. <a href="https://app.daily.dev/posts/6x4IdBLjT" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
