<h2>Must know</h2>
<ul>
<li><strong>Rust infrastructure team Q4 recap and Q1 2026 plan</strong>: The Rust Infrastructure Team wrapped up Q4 2025 with significant upgrades, including migrating to the new Bors bot for CI and moving <a href="http://crates.io" target="_blank" rel="noopener nofollow">crates.io</a> index and <a href="http://docs.rs" target="_blank" rel="noopener nofollow">docs.rs</a> to Fastly CDN. They also expanded Infrastructure as Code coverage for GitHub environments and trusted publishing, as reported by the Inside Rust Blog. For Q1 2026, plans include modernizing <a href="http://docs.rs" target="_blank" rel="noopener nofollow">docs.rs</a> infrastructure, establishing an external hardware CI policy, and migrating to GitHub Rulesets, indicating a continued focus on stability and security. <a href="https://app.daily.dev/posts/m2OVQmP6S" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft patches actively exploited Windows 0-day</strong>: Microsoft released a critical patch for CVE-2026-20805, an actively exploited information disclosure vulnerability in Windows that could bypass ASLR. CISA has added this to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch by February 3. This is part of Microsoft’s January 2026 Patch Tuesday, which addressed 112 CVEs, including several critical remote code execution flaws in Office, as reported by multiple security sources. Organizations are urged to update immediately. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js releases security fixes for multiple CVEs</strong>: Node.js released versions 20.20.0 (LTS) and 25.3.0 (Current) with security fixes for multiple CVEs, including a denial-of-service vulnerability from stack space exhaustion. These updates address issues like adding a default error handler to TLSSocket, disabling futimes when the permission model is enabled, and stricter read/write permissions for symlink APIs, according to official Node.js disclosures. Developers using async_hooks, React Server Components, and Next.js are particularly advised to update. <a href="https://app.daily.dev/feed-by-ids?id=DwsoMgMKH&amp;id=ImHNcBPhJ&amp;id=ZoKLGVJ9V&amp;id=uw83EGG5r&amp;id=Zr0Dv9dwZ&amp;id=37PkHkE8t" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Bifrost: a fast Go-based LLM gateway</strong>: Bifrost is an open-source LLM gateway written in Go, offering unified access to over 15 AI providers via a single OpenAI-compatible API, boasting 40x lower latency and 68% lower memory usage than LiteLLM. <a href="https://app.daily.dev/posts/P8RYoHcNL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Convex offers a new approach to application databases</strong>: Convex provides a unique application database where all state is managed as TypeScript files within your project, offering automatic type safety, real-time sync, and intelligent caching, making it ideal for AI agent development. <a href="https://app.daily.dev/posts/lu0cr2ba9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agent vulnerabilities found in ServiceNow and Superhuman</strong>: Critical vulnerabilities were discovered in ServiceNow’s Virtual Agent and Superhuman AI, allowing attackers to gain system control or exfiltrate emails through weak authentication and prompt injection, respectively. <a href="https://app.daily.dev/feed-by-ids?id=2A2nfRTHq&amp;id=EDFS33r2W" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Advanced VoidLink Linux malware targets cloud and containers</strong>: Check Point Research identified VoidLink, an advanced Linux malware written in Zig, designed to target cloud and container environments like Docker and Kubernetes, featuring 37+ modular plugins for credential harvesting and evasion. <a href="https://app.daily.dev/feed-by-ids?id=uJaIfhgHH&amp;id=QWUKVWdsK&amp;id=x9wl564Rc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Git subtree for monorepo migrations</strong>: Git subtree is a powerful tool for migrating repositories into a monorepo while preserving commit history, crucial for integrating projects like Next.js web apps into pnpm workspaces. <a href="https://app.daily.dev/posts/tscYtScxZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Metabase 58 streamlines embedding options</strong>: Metabase 58 consolidates embedding options into Modular Embedding and Full-app Embedding, with an in-app setup wizard and React SDK to simplify integration for individual components or entire applications. <a href="https://app.daily.dev/posts/hE2tQMzYx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PHP DebugBar v3 modernizes features</strong>: PHP DebugBar v3.0.0 transitions to vanilla JavaScript, replaces FontAwesome with Tabler SVG icons, and introduces performance improvements through lazy widget rendering and enhanced timeline support. <a href="https://app.daily.dev/posts/b7SEEaaFE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Meta’s AI leadership shakeup and Llama 4 manipulation claims</strong>: Yann LeCun, Meta’s former chief AI scientist, apparently stormed out after Alexander Wang, CEO of Scale AI, was appointed head of superintelligence. LeCun, in what sounds like a very professional exit interview, publicly called Wang inexperienced and accused Meta’s AI team of manipulating Llama 4 test results. So, Meta’s AI future is now in the hands of someone LeCun thinks is unqualified, and their flagship model might be a bit… embellished. Nothing to see here, just standard corporate drama, but with more qubits. <a href="https://app.daily.dev/posts/ILAkYeoup" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated book spam: the new frontier of ‘content’</strong>: HiTeX Press has managed to publish over 800 technical books in a single year, all generated by AI, without a single human bothering to fact-check them. Apparently, these masterpieces include hallucinated code and features that don’t even exist in the languages they’re supposedly about. For just 8€ a pop on Amazon, you too can own a book that’s completely useless. It’s a bold new world where quantity trumps quality, and critical thinking is apparently optional for both authors and publishers. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft’s ‘community-first’ AI data centers: because greenwashing is cheaper than actual green energy</strong>: Microsoft, facing a massive public backlash over its energy-hungry data centers, has suddenly discovered a ‘community-first’ approach. They’re now pledging to pay full electricity costs, minimize water use, and create local jobs. This sudden burst of corporate responsibility comes after protests in 24 states and withdrawing from a Wisconsin project. It’s almost as if they realized that ignoring community concerns and environmental impact might actually cost them more in the long run than just, you know, paying their fair share. But hey, at least they’re promising to invest in AI training for locals—because nothing says ‘we care’ like teaching people to manage the very AI infrastructure that’s draining their resources. <a href="https://app.daily.dev/posts/jqtBl3Jnb" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
