<h2>Must know</h2>
<ul>
<li><strong>Node.js critical DoS vulnerability impacts major frameworks</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js, affecting versions 8.x through 24.x, can cause process crashes if <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled. This impacts major frameworks like Next.js and React Server Components, as well as APM tools such as Datadog, New Relic, and OpenTelemetry. Node.js has released patches for supported versions 20.20.0, 22.22.0, 24.13.0, and 25.3.0, which are crucial for immediate upgrade, as reported by Node.js release notes and Datadog. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday addresses critical zero-day and Secure Boot flaws</strong>: Microsoft’s January 2026 Patch Tuesday includes critical security updates for 112-114 vulnerabilities. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR, requiring local access. CISA has added this to its Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026. Additionally, fixes for expiring Secure Boot certificates from 2011 and 2026 are included, alongside multiple Office RCE vulnerabilities, as detailed by Krebs on Security and BleepingComputer. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical AI agent authentication flaw in ServiceNow Virtual Agent</strong>: AppOmni and ServiceNow confirmed a critical vulnerability (CVE-2025-12420, ‘BodySnatcher’) in ServiceNow’s Virtual Agent AI platform. This flaw allowed unauthenticated attackers to impersonate any user with just an email address, bypassing MFA and passwords. The vulnerability, rooted in weak authentication combined with new AI capabilities, could lead to admin account creation and privilege escalation across connected modules. ServiceNow promptly issued a patch and removed the exploited AI agent functionality, emphasizing the systemic risk of rapid AI agent integration, as highlighted by both AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Rust in safety-critical systems: challenges and recommendations</strong>: While Rust is used in production safety-critical systems like medical devices, higher criticality levels face challenges with third-party dependencies, toolchain stability, and async runtime qualification, requiring careful MSRV conventions and dependency lifecycle documentation. <a href="https://app.daily.dev/posts/kV5hg8yNn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents port Rust to Go with minimal human intervention</strong>: An experienced developer successfully ported a Rust-based Jinja2 template engine to native Go using AI agents, taking 45 minutes of active guidance and 10 hours of autonomous work, highlighting AI’s potential for cross-language porting. <a href="https://app.daily.dev/posts/VOMBPE1Xs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>U.S. federal agencies prepare for quantum security migration</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to implementation of quantum security practices, focusing on ‘harvest now, decrypt later’ threats and encouraging hybrid cryptographic solutions. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor code editor optimizes AI token usage with dynamic context discovery</strong>: Cursor, an AI code editor, introduced dynamic context discovery to reduce LLM token consumption by 46.9% by accessing code context only when needed, aiming for lower operational costs and faster AI response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Thunderbird 147 released with new features</strong>: Firefox 147 introduces automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU support for Apple Silicon, and zero-copy hardware video playback for AMD GPUs, while Thunderbird 147 adds a ‘Show Full Path’ option and optional folder-name localization. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks partnerships enhance AI-driven data insights</strong>: Atlassian Rovo now integrates with Databricks AI/BI Genie for natural language queries, and Algonomy launched RetailAI on Databricks for agentic AI-driven retail planning, both aiming to democratize data access and move to predictive operations. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine for LLM API monitoring launched</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, cost, performance, and error rates within Rails applications, providing a dashboard and configurable alerts for cost management and optimization. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: the new junior developer, or just more code to review?</strong>: Senior developers are pointing out that LLM agentic coding tools are slow, require significant supervision, and don’t actually boost productivity for experienced programmers. While some claim AI improves development speed and throughput, others find AI-generated code functionally correct but architecturally deficient, especially in complex domains like Android. So, it seems we’re just trading writing code for reviewing more code, and the ‘senior engineer’ AI is still very much in beta. <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bandcamp bans AI-generated music, because authenticity is still a thing</strong>: Bandcamp, bless their hearts, has decided to ban music created ‘wholly or substantially by AI,’ effective January 2026. Apparently, they want to protect human musicians and ensure fans get authentic music, unlike Spotify, which is drowning in AI-generated tracks. It’s almost as if a platform focused on direct artist-to-fan sales has a different business model than one trying to monetize every last bit of noise. Who knew? <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated technical books: the new frontier of spam</strong>: HiTeX Press, a true innovator, has managed to release over 800 technical books in a single year, all created entirely by AI with zero human oversight. These masterpieces feature fabricated code, non-existent programming features, and are often ‘meaningless,’ yet they’re being sold on major platforms like Amazon. It’s a bold new world where technical learners get to sift through industrial-level spam to find actual knowledge. What a time to be alive! <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
