<h2>Must know</h2>
<ul>
<li><strong>Node.js critical DoS vulnerability patched</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) has been discovered in Node.js, affecting versions 8.x through 24.x. This flaw causes process crashes if <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled, impacting major frameworks like Next.js and React Server Components, as well as APM tools like Datadog. Node.js has released patches for supported versions 20.20.0, 22.22.0, 24.13.0, and 25.3.0, which are crucial for preventing server termination and service downtime, according to Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full impersonation</strong>: A critical vulnerability, dubbed BodySnatcher (CVE-2025-12420), was found in ServiceNow’s Virtual Agent AI platform. This flaw allowed unauthenticated attackers to impersonate any user with just an email address, bypassing passwords and MFA. The exploit could lead to admin account creation, access to connected modules (HR, customer service), and privilege escalation across integrations via the Virtual Agent API. ServiceNow has since issued a patch, rotated credentials, and removed the exploited AI agent functionality, as confirmed by AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday addresses critical zero-day</strong>: Microsoft’s January 2026 Patch Tuesday includes fixes for 112-114 vulnerabilities, with eight critical ones. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR and leak memory addresses. CISA has added this to its Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026. Other fixes address Office RCEs and Secure Boot certificate expirations, as reported by Krebs on Security and The Hacker News. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Databricks expands AI partnerships for data insights</strong>: Databricks is integrating with Atlassian Rovo to enable natural language queries on enterprise data and partnering with Algonomy to deliver RetailAI for agentic retail planning, leveraging Databricks’ platform for predictive operations. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI editor optimizes token usage with dynamic context</strong>: Cursor, an AI code editor, introduced dynamic context discovery to reduce LLM token consumption by 46.9% by accessing code context only when needed, aiming for faster AI responses and lower operational costs. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel adds support for new GPUs in Compute Runtime</strong>: Intel’s Compute Runtime version 26.01.36711.4 now includes initial support for Crescent Island and Nova Lake S graphics hardware, continuing support for Level Zero and OpenCL APIs. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 brings picture-in-picture and platform optimizations</strong>: Firefox 147 introduces automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU support for Apple Silicon, zero-copy hardware video playback for AMD GPUs on PC, and XDG Base Directory support for Linux. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine monitors LLM API usage and costs</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and error rates within Rails applications, providing a dashboard and configurable alerts for cost management and optimization. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PostgreSQL performance fix for slow deletes</strong>: Outdated table statistics were identified as the cause of slow DELETE operations in PostgreSQL; running <code>VACUUM ANALYZE</code> updated statistics, enabling the query planner to use index scans and dramatically reduce execution time. <a href="https://app.daily.dev/posts/u4YoS0LCO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pulumi IAM now available for self-hosted cloud</strong>: Pulumi IAM with Custom Roles and scoped Access Tokens is now available for self-hosted Pulumi Cloud, enabling fine-grained permissions, Zero Trust security, and auditable access control for CI/CD automation. <a href="https://app.daily.dev/posts/wd03nDp6A" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated books: the new frontier of technical spam</strong>: Apparently, HiTeX Press has managed to churn out over 800 technical books in a single year, all AI-generated with fabricated code and non-existent features. These masterpieces, penned by two pseudonymous authors, are flooding major platforms like Amazon, making it nearly impossible for actual learners to find reliable information. It’s not just bad content; it’s an industrial-scale spam operation polluting the technical publishing landscape, and nobody seems to be doing anything about it. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents: still not senior engineers, but great for junior tasks</strong>: Senior developers are still scratching their heads over the hype around LLM agentic coding tools, finding them slow, needy, and not exactly a productivity booster for anyone with actual experience. While they might be great for documentation or letting non-developers dabble in code, AI-generated Kotlin code, for instance, is functionally correct but architecturally a mess, mishandling coroutines and lifecycle management. So, while some claim AI improves development speed, it seems we’re still a long way from replacing anyone who knows what they’re doing, despite the ‘insecure evangelism’ of LLM maximalists. <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bandcamp bans AI music, because authenticity is still a thing</strong>: In a bold move against the rising tide of AI-generated content, Bandcamp has decided to ban music created wholly or substantially by AI, effective January 2026. While Spotify is busy letting AI flood its platform, Bandcamp is sticking up for human artists, citing protection of authenticity and encouraging users to report suspected AI tracks. It’s almost as if some platforms still believe in supporting actual creators, unlike those chasing the next big AI-generated chart-topper, even if it means facing lawsuits over copyright infringement. <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
