<h2>Must know</h2>
<ul>
<li><strong>Critical Node.js DoS vulnerability impacts major frameworks</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js, affecting versions 8.x through 24.x, can crash applications using <code>async_hooks</code> or <code>AsyncLocalStorage</code>. This impacts major frameworks like Next.js and React Server Components, as well as APM tools such as Datadog, New Relic, and OpenTelemetry. Node.js has released patches for supported versions, and immediate upgrades are recommended to prevent server termination and downtime, as confirmed by Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full impersonation</strong>: A critical vulnerability, dubbed BodySnatcher (CVE-2025-12420), was discovered in ServiceNow’s Virtual Agent AI platform. This flaw allowed unauthenticated attackers to impersonate any user, bypassing password and MFA, simply with an email address and a universal credential. The exploit could lead to admin account creation, access to connected modules, and privilege escalation across integrations. ServiceNow has since issued a patch, rotated credentials, and removed the exploited AI agent functionality, as reported by AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday addresses critical zero-day</strong>: Microsoft’s January 2026 Patch Tuesday includes fixes for 112-114 vulnerabilities, with eight critical ones. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR and leak memory addresses. CISA has added this to its Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026. Other fixes address Office RCEs and Secure Boot certificate expirations, according to Krebs on Security and The Hacker News. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cursor AI editor optimizes LLM token usage</strong>: Cursor, an AI code editor, introduced dynamic context discovery, reducing LLM token consumption by 46.9% by retrieving code context on-demand, which lowers costs and speeds up AI responses. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents for security research and automation</strong>: GitHub Security Lab released Taskflow Agent, an open-source framework using AI and natural language to automate security research via YAML-based taskflows and Model Context Protocol (MCP) interfaces. <a href="https://app.daily.dev/posts/zVkqeCNSc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New Rails engine monitors LLM API usage and costs</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and errors within applications, providing a dashboard and configurable alerts for cost management and optimization. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks and Atlassian Rovo integrate for conversational insights</strong>: Atlassian Rovo now integrates with Databricks AI/BI Genie, allowing users to query enterprise data in plain English and receive real-time insights without SQL expertise, democratizing data access. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel adds support for new GPUs in Compute Runtime</strong>: Intel’s Compute Runtime version 26.01.36711.4 introduces initial support for Crescent Island and Nova Lake S graphics hardware, maintaining Level Zero and OpenCL API compatibility. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 enhances video playback and privacy</strong>: Firefox 147 adds automatic Picture-in-Picture, reorganizes tab settings, enhances WebGPU support for Apple Silicon, and improves privacy with tightened Enhanced Tracking Protection and Google Safe Browsing v5. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>U.S. federal agencies prepare for quantum security migration</strong>: U.S. federal agencies, including FBI, NIST, and CISA, are moving to implement post-quantum cryptography (PQC) standards to counter ‘harvest now, decrypt later’ threats, urging immediate inventory of cryptographic assets. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: the new junior dev that needs constant supervision</strong>: Apparently, AI agents are now ‘autonomous systems’ that can handle complex workflows, but senior developers are still finding them slow, requiring significant supervision, and not really boosting productivity. It seems we’re just shifting from debugging human code to debugging AI’s ‘architecturally deficient’ output, as one Android dev pointed out. So much for replacing us, they’re just giving us more junior devs to babysit. <a href="https://app.daily.dev/feed-by-ids?id=GMZHoSF60&amp;id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated books: the new frontier of technical misinformation</strong>: HiTeX Press has apparently flooded the market with over 800 AI-generated technical books in a single year, complete with fabricated code and non-existent features. Because nothing says ‘expert knowledge’ like a book written by an algorithm that hallucinates programming concepts. Good luck to anyone trying to learn from these masterpieces; it’s like a treasure hunt, but the treasure is just more garbage. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quantum cameras: 20x resolution, 1000x faster, zero independent verification</strong>: Diffraqtion, a spinout from MIT and UMD, just secured $4.2 million for a ‘quantum camera’ that promises 20x higher resolution and 1,000x faster processing for satellites. These claims, straight from the company’s mouth, are truly astounding—especially since there’s no independent verification. I’m sure it’s not just another ‘quantum leap’ in marketing, right? Just wait for the demonstrations in early 2026, I’m sure they’ll be totally transparent. <a href="https://app.daily.dev/feed-by-ids?id=A9H2rpmDZ&amp;id=NhGwNaYRA&amp;id=isGrxmwaT&amp;id=wjXnstnI7" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
