<h2>Must know</h2>
<ul>
<li><strong>Critical Node.js DoS vulnerability impacts major frameworks</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js, affecting versions 8.x through 24.x, can crash applications using <code>async_hooks</code> or <code>AsyncLocalStorage</code> due to unhandled stack overflows. This impacts major frameworks like Next.js and React Server Components, as well as APM tools such as Datadog, New Relic, and OpenTelemetry. Node.js has released patches for supported versions, and immediate upgrades are crucial to prevent service downtime, as reported by Node.js release notes and Datadog. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full impersonation</strong>: AppOmni and ServiceNow confirmed a critical vulnerability (CVE-2025-12420, ‘BodySnatcher’) in ServiceNow’s Virtual Agent AI platform. This flaw allowed unauthenticated attackers to impersonate any user with just an email address, bypassing passwords and MFA. The exploit could lead to admin account creation, access to connected modules (HR, customer service), and privilege escalation across integrations. ServiceNow has since patched the issue, rotated credentials, and removed the exploited AI agent functionality, highlighting the systemic risks of rapidly integrating AI agents, according to both AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday includes actively exploited zero-day</strong>: Microsoft’s January 2026 Patch Tuesday addressed 112-114 vulnerabilities, including eight critical ones. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR and leak memory addresses, increasing risk in exploit chains. CISA has added this to their Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026. Fixes also cover Office RCEs, Secure Boot certificate issues, and legacy driver removals, as detailed by Krebs on Security and The Hacker News. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Databricks and Atlassian Rovo integrate for conversational data insights</strong>: Atlassian Rovo now integrates with Databricks AI/BI Genie, allowing users to query enterprise data in plain English and receive real-time insights without SQL expertise, aiming to democratize data access and reduce knowledge silos. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New Rails engine monitors LLM API usage and costs</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and error rates within Rails applications, providing a dashboard and configurable alerts for cost management and optimization. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI editor optimizes token usage with dynamic context discovery</strong>: Cursor, an AI code editor, introduced dynamic context discovery to reduce LLM token consumption by 46.9% by accessing code context only when needed, aiming for lower operational costs and faster AI response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>U.S. federal agencies prepare for quantum security migration</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to implementation of quantum security practices, focusing on migrating to post-quantum cryptography (PQC) to counter ‘harvest now, decrypt later’ attacks. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Compute Runtime adds support for new GPUs</strong>: Intel’s Compute Runtime version 26.01.36711.4 introduces initial support for Crescent Island and Nova Lake S graphics hardware, continuing support for Level Zero and OpenCL APIs. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Thunderbird 147 released with new features</strong>: Firefox 147 adds automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU support for Apple Silicon, and zero-copy hardware video playback for AMD GPUs, while Thunderbird 147 introduces a ‘Show Full Path’ option and optional folder-name localization. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quantum dot breakthrough for telecom C-band communication</strong>: Researchers developed a single-photon source using InAs quantum dots operating in the telecom C-band, achieving 91.7% two-photon interference visibility, a record for solid-state sources in this range, potentially enabling practical quantum networks. <a href="https://app.daily.dev/posts/woujp8xYd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated technical books flood Amazon, because quality is for suckers</strong>: Apparently, HiTeX Press has managed to churn out over 800 technical books in a single year, all ‘created entirely by AI without human oversight.’ These masterpieces feature ‘fabricated code examples’ and ‘non-existent programming features,’ making them perfect for anyone who enjoys learning from meaningless content. And of course, they’re available on Amazon, because why bother with quality control when you can just spam the market with AI-generated garbage? <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents: the new junior developers who still need constant supervision</strong>: The hype machine is now reframing AI agents as ‘autonomous systems’ that can handle complex workflows, but don’t worry, they still need ‘limited supervision.’ Apparently, we’re just shifting developers’ roles towards ‘architecture, verification, and high-level orchestration’ because these ‘junior partners’ can’t quite manage senior-level judgment. So, instead of replacing engineers, we’re just creating more work to babysit our ‘autonomous’ AI, all while dealing with new security challenges like prompt injection. Progress! <a href="https://app.daily.dev/feed-by-ids?id=GMZHoSF60&amp;id=Jj0H2b0XQ&amp;id=SMEJx6ENk&amp;id=Z1R08OC6I&amp;id=ZBZXWSG4p&amp;id=ZsPWeN0Lt&amp;id=dl9u8nkjK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bandcamp bans AI music, because human creativity is still a thing</strong>: In a shocking display of common sense, Bandcamp has decided to ban music ‘created wholly or substantially by AI,’ effective January 2026. Their reasoning? To ‘protect human musicians’ and assure fans of ‘music authenticity.’ This, of course, stands in stark contrast to platforms like Spotify, which are apparently fine with being flooded by AI-generated tracks, some of which are even making it onto major charts. Who knew a platform focused on direct artist-to-fan sales would actually care about the artists? <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
