<h2>Must know</h2>
<ul>
<li><strong>Critical DoS vulnerability in Node.js async_hooks</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) has been discovered in Node.js, affecting versions 8.x through 24.x. This flaw causes process crashes due to uncatchable stack overflows when <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled, impacting major frameworks like Next.js and React Server Components, as well as APM tools like Datadog. Node.js has released patches for supported versions, and immediate upgrades are recommended to prevent service downtime, according to Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full impersonation</strong>: A critical vulnerability, dubbed BodySnatcher (CVE-2025-12420), was found in ServiceNow’s Virtual Agent AI platform. This flaw allowed unauthenticated attackers to impersonate any user, bypassing MFA and passwords, simply with an email address and a universal credential. The exploit could lead to admin account creation, access to connected modules, and privilege escalation across integrations, highlighting the systemic risks of rapidly integrating AI agents without robust security controls, as detailed by AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>U.S. federal agencies ramp up quantum security</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to active implementation of quantum security practices. Their focus is on mitigating “harvest now, decrypt later” attacks by migrating to post-quantum cryptography (PQC) standards finalized by NIST. This multi-year effort requires immediate inventory of cryptographic assets and the adoption of hybrid solutions, emphasizing quantum security as a present and future necessity, according to statements from these agencies. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cursor AI editor optimizes token usage with dynamic context</strong>: Cursor, an AI code editor, introduced dynamic context discovery, a technique that reduces LLM token consumption by 46.9% by allowing AI agents to retrieve code context on-demand rather than pre-loading all data, leading to lower costs and faster response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Trends and Kaggle enhance AI usability</strong>: Google Trends now integrates Gemini AI to identify and compare related search trends, while Kaggle released Community Benchmarks, allowing users to create and share custom evaluation tasks for AI models, expanding evaluation opportunities beyond research groups. <a href="https://app.daily.dev/feed-by-ids?id=WhUrXR4tI&amp;id=XLEr4o2U6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks expands AI partnerships for data insights</strong>: Databricks is partnering with Atlassian Rovo for natural language queries on enterprise data and with Algonomy to deliver RetailAI for agentic retail planning, aiming to democratize data access and move organizations towards predictive operations. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New open-source framework for LLM memory management</strong>: MemOS is an open-source Memory Operating System for LLMs and AI agents that provides unified long-term memory management with a graph-structured storage, multi-modal memory support, and claims significant accuracy improvements and token savings. <a href="https://app.daily.dev/posts/bjqQdB8fJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine for LLM API monitoring released</strong>: RubyLLM::Monitoring is a new Rails engine designed to track LLM API usage, cost, performance, and error rates within Rails applications, offering a dashboard and configurable alerts for cost management and performance optimization. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel adds support for new GPUs</strong>: Intel’s Compute Runtime version 26.01.36711.4 introduces initial support for Crescent Island and Nova Lake S graphics hardware, continuing Level Zero and OpenCL API support for GPUs back to Tiger Lake. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Thunderbird 147 released</strong>: Firefox 147 introduces automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU support for Apple Silicon, and zero-copy hardware video playback for AMD GPUs, while Thunderbird 147 adds a ‘Show Full Path’ option and optional folder-name localization. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents are the new insider threat, but don’t worry, we have an AI to fix it</strong>: Apparently, AI agents with elevated privileges are now insider threats, susceptible to prompt injection and even capable of remotely compromising humanoid robots via voice commands. But fear not, Living Security is testing ‘Livvy,’ an AI engine designed to predict risky user behaviors and manage these AI agent-driven insider threats. So, the solution to AI creating new security holes is… more AI. What could possibly go wrong? <a href="https://app.daily.dev/feed-by-ids?id=MpJOJGOmA&amp;id=bwVFAnzEc&amp;id=c8Xk5dH7c" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated books: The future of technical publishing, apparently</strong>: HiTeX Press has managed to release over 800 technical books in a single year, all entirely AI-generated with fabricated code examples and non-existent features, and they’re selling them on Amazon. Because nothing says ‘expert knowledge’ like a book written by an algorithm that hallucinates programming concepts. Good luck to anyone trying to learn from this industrial-scale spam. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>LLM maximalists: It’s not that AI coding tools are bad, you’re just insecure</strong>: Senior developers are critiquing LLM coding tools as slow and requiring too much supervision, but apparently, this skepticism is just a sign of their ‘insecurity’ or ‘aversion to change.’ Because obviously, if an experienced engineer finds an AI tool inefficient, it must be a personal failing, not a flaw in the tool itself. The hype train continues, full steam ahead, over the cliff. <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
