<h2>Must know</h2>
<ul>
<li><strong>Critical Node.js vulnerability impacts major frameworks</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js’s <code>async_hooks</code> and <code>AsyncLocalStorage</code> can crash applications, affecting major frameworks like Next.js and React Server Components, as well as APM tools like Datadog. Patches have been released for Node.js versions 20.20.0, 22.22.0, 24.13.0, and 25.3.0, which prevent fatal process exits by re-throwing stack overflow errors to user code. This requires immediate upgrades for production environments, as highlighted by Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full impersonation</strong>: ServiceNow’s Virtual Agent AI platform had a critical flaw (CVE-2025-12420, “BodySnatcher”) that allowed unauthenticated attackers to impersonate any user with just an email address, bypassing passwords and MFA. This vulnerability, confirmed by AppOmni and ServiceNow, could lead to admin account creation, privilege escalation across connected modules, and rogue AI agents. While no active exploitation was found, ServiceNow promptly issued a patch, rotated credentials, and removed the exploited AI agent functionality, emphasizing the growing risks of AI agent integration. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday includes actively exploited zero-day</strong>: Microsoft’s January 2026 Patch Tuesday addressed 112-114 vulnerabilities, including eight critical ones. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR, leaking memory addresses. CISA has added this to its Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026. This highlights the urgent need for organizations to apply these updates, as reported by Krebs on Security and The Hacker News. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>React ecosystem updates and framework convergence</strong>: The React ecosystem sees updates like Next.js 16.1, Immer 11.1, and Waku 1.0 alpha, while React Native gets Voltra 1.0 for Live Activities and Hermes V1 by default in 0.84 RC. Frameworks like Next.js, Expo Router, and Redwood are converging, exploring AI integration via Model Context Protocol (MCP) endpoints. <a href="https://app.daily.dev/feed-by-ids?id=oWHYd6BqQ&amp;id=Ii8I7s3X0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI editor boosts token efficiency</strong>: Cursor, an AI code editor, introduced dynamic context discovery, reducing LLM token usage by 46.9% by retrieving code context on-demand. This aims to lower operational costs, speed up AI responses, and minimize hallucinations by providing only relevant information. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Thunderbird 147 released</strong>: Firefox 147 introduces automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU for Apple Silicon, and zero-copy hardware video playback for AMD GPUs, alongside security fixes and Google Safe Browsing v5. Thunderbird 147 adds a ‘Show Full Path’ option and optional folder-name localization. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Trends and Kaggle enhance AI usability</strong>: Google Trends now integrates Gemini AI to identify and compare related search trends, supporting up to eight terms and displaying more rising queries. Kaggle released Community Benchmarks, allowing users to create, run, and share custom evaluation tasks for AI models with multi-model inputs and leaderboards. <a href="https://app.daily.dev/feed-by-ids?id=WhUrXR4tI&amp;id=XLEr4o2U6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New Rails engine monitors LLM API usage</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, cost, performance, and error rates within applications, offering a dashboard and configurable alerts for cost ceilings or performance degradation, all stored internally for privacy. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Godot 4.6 RC 1 is ready for testing</strong>: Godot 4.6 has reached Release Candidate 1, featuring a new editor theme, inverse kinematics, standalone library support, and over 100 fixes since beta 3, making it ready for production testing. <a href="https://app.daily.dev/posts/6eabvt90Q" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Elixir 1.19 brings faster builds and smarter types</strong>: Elixir 1.19 improves compilation speeds by up to 4x through lazy module loading and parallel dependency compilation, while its type system evolves to find bugs without requiring annotations, and emphasizes interoperability with other ecosystems. <a href="https://app.daily.dev/posts/0z5pHaJQi" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: the new bottleneck is still us</strong>: Apparently, AI-powered coding agents are so good that the bottleneck has shifted from writing code to defining requirements. InfoWorld suggests developers will now spend more time reviewing and refactoring AI output. So, instead of writing bad code ourselves, we’ll just be managing AI that writes bad code, proving that no matter how advanced the tools, human inefficiency will always find a way to shine. <a href="https://app.daily.dev/posts/H430dwVHX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated books: the spam nobody asked for</strong>: HiTeX Press has managed to churn out over 800 AI-generated technical books in a single year, complete with fabricated code and non-existent features, all under pseudonymous authors. These masterpieces are being sold on major platforms like Amazon, making it harder for actual humans to find reliable information. Because nothing says ‘progress’ like industrial-scale misinformation polluting the technical publishing world. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bandcamp bans AI music: protecting artists or just being picky?</strong>: Bandcamp has decided to ban ‘wholly or substantially’ AI-generated music, citing a need to protect human artists and ensure authenticity. This is a bold move, especially when AI music is hitting major charts and getting big investments, as seen with Suno’s $250 million raise. So, while Spotify embraces the AI deluge, Bandcamp is drawing a line in the sand, presumably to keep their platform pure for the few human artists left who haven’t been replaced by algorithms. <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
