<h2>Must know</h2>
<ul>
<li><strong>Node.js DoS vulnerability impacts major frameworks and APM tools</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js, affecting versions 8.x through 24.x, can crash applications using <code>async_hooks</code> or <code>AsyncLocalStorage</code>. This impacts major frameworks like Next.js and React Server Components, as well as APM tools such as Datadog, New Relic, and OpenTelemetry. Node.js has released patches for supported versions, and immediate upgrades are recommended to prevent server termination and service downtime, as confirmed by Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical vulnerability in ServiceNow Virtual Agent allowed unauthenticated access</strong>: ServiceNow’s Virtual Agent AI platform had a critical vulnerability (CVE-2025-12420, ‘BodySnatcher’) that allowed unauthenticated attackers to impersonate any user with just an email address, bypassing passwords and MFA. This flaw, rooted in weak authentication combined with new AI capabilities, could have led to admin account creation, privilege escalation across connected modules, and rogue AI agents. ServiceNow has patched the issue, rotated credentials, and removed the exploited AI functionality, as reported by AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday addresses critical zero-day and Secure Boot flaws</strong>: Microsoft’s January 2026 Patch Tuesday includes fixes for 112-114 vulnerabilities, with eight critical ones. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR, increasing risk in exploit chains. CISA has added this to its Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026. Additionally, patches address certificate expiration issues in Secure Boot from 2011 and upcoming 2026 expirations, as detailed by Krebs on Security and BleepingComputer. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Uber serves 150 million reads per second with consistent caching</strong>: Uber’s CacheFront system handles over 150 million database reads per second using Redis with strong consistency, employing a three-layer architecture and a triple-defense strategy of soft deletes, monotonic timestamps, and synchronous write-path invalidation to achieve high cache hit rates and near-zero stale values. <a href="https://app.daily.dev/posts/MjLSYgXjr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>U.S. federal agencies prepare for quantum security migration</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to implementation of quantum security practices, focusing on migrating to post-quantum cryptography (PQC) to counter ‘harvest now, decrypt later’ attacks, with NIST finalizing initial PQC standards. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI code editor optimizes token usage with dynamic context discovery</strong>: Cursor, an AI code editor, introduced dynamic context discovery to reduce LLM token consumption by 46.9% by accessing code context only when needed, aiming for lower operational costs and faster AI response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quantum dot breakthrough for telecom C-band single-photon sources</strong>: Researchers developed a quantum dot-based single-photon source operating in the telecom C-band, achieving 91.7% two-photon interference visibility, a record for solid-state sources in this range, potentially enabling practical quantum networks. <a href="https://app.daily.dev/posts/woujp8xYd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine launched for LLM API monitoring and cost management</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and error rates within Rails applications, providing a dashboard and configurable alerts for cost optimization and performance insights. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Thunderbird 147 released with new features</strong>: Firefox 147 introduces automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU support for Apple Silicon, and zero-copy hardware video playback for AMD GPUs, while Thunderbird 147 adds a ‘Show Full Path’ option and optional folder-name localization. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Compute Runtime adds support for new GPUs</strong>: Intel’s Compute Runtime version 26.01.36711.4 introduces initial support for Crescent Island and Nova Lake S graphics hardware, continuing Level Zero and OpenCL API support for GPUs back to Tiger Lake. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: the new ‘senior engineers’ who can’t even handle a <code>for</code> loop</strong>: Apparently, AI agents are now so advanced they can port Rust to Go in 10 hours, but still can’t write production-grade Android code without messing up coroutines and memory management. One developer claims AI makes cross-language ports feasible with ‘minimal manual intervention,’ while others find AI-generated code ‘architecturally deficient’ and full of ‘unnecessary complexity.’ So, are we replacing senior engineers or just creating more work for them to fix AI’s ‘functional but flawed’ output? The hype machine keeps churning, but the code still needs a grown-up. <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd&amp;id=VOMBPE1Xs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated books: because who needs actual knowledge when you have 800 meaningless titles?</strong>: HiTeX Press has apparently mastered the art of industrial-scale spam, releasing over 800 AI-generated technical books in a single year, complete with fabricated code and non-existent features. These masterpieces, priced at 8€ each, are flooding major platforms like Amazon, making it nearly impossible for actual learners to find legitimate resources. It’s a brilliant strategy: pollute the market with enough garbage, and eventually, no one will trust anything, solving the ‘knowledge gap’ by eliminating knowledge itself. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI governance: the new ‘top IT concern’ that nobody actually governs</strong>: IT leaders are suddenly very concerned about AI governance, with 54% rating it as ‘core,’ nearly double last year. This newfound urgency comes as AI agents are being reframed as ‘autonomous systems’ that can handle complex workflows with ‘limited supervision.’ The solution? ‘Sandboxing, restrictive access controls, and human escalation for critical tasks.’ Because, you know, we’ve never had issues with those before. It’s almost as if rapid AI adoption is outpacing enterprise security controls, and now everyone’s scrambling to put a fancy governance label on the chaos. <a href="https://app.daily.dev/feed-by-ids?id=GMZHoSF60&amp;id=Jj0H2b0XQ&amp;id=SMEJx6ENk&amp;id=Z1R08OC6I&amp;id=ZBZXWSG4p&amp;id=ZsPWeN0Lt&amp;id=dl9u8nkjK&amp;id=6sWfFYM3R" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
