<h2>Must know</h2>
<ul>
<li><strong>Critical Node.js vulnerability impacts major frameworks and APM tools</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js affects versions 8.x through 24.x, causing process crashes when <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled. This impacts widely used frameworks like Next.js and React Server Components, as well as APM tools such as Datadog, New Relic, and OpenTelemetry. Node.js has released patches for supported versions, and immediate upgrades are crucial to prevent service downtime, as confirmed by Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full user impersonation</strong>: A critical vulnerability, dubbed ‘BodySnatcher’ (CVE-2025-12420), was discovered in ServiceNow’s Virtual Agent AI platform. This flaw allowed unauthenticated attackers to impersonate any user using only an email address and a universal credential, bypassing password and MFA. The exploit could lead to admin account creation, access to connected modules, and privilege escalation across integrations. ServiceNow has since issued a patch, rotated credentials, and removed the exploited AI agent functionality, as reported by AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday addresses critical zero-day and Secure Boot flaws</strong>: Microsoft’s January 2026 Patch Tuesday includes critical security updates for 112-114 vulnerabilities. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR, prompting CISA to mandate federal patching. The update also fixes multiple Office RCE vulnerabilities and critical Secure Boot certificate expiration issues from 2011, with new certificates expiring in 2026 requiring urgent attention, according to Krebs on Security and The Hacker News. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>U.S. federal agencies begin quantum security migration</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to implementation of quantum security, focusing on migrating to post-quantum cryptography (PQC) to counter ‘harvest now, decrypt later’ attacks, with NIST finalizing initial PQC standards. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bandcamp bans substantially AI-generated music</strong>: Bandcamp has announced a ban on music and audio created wholly or substantially by AI, effective January 2026, aiming to protect human artists and ensure authenticity, a move that diverges from platforms like Spotify. <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks expands AI partnerships for data insights and retail</strong>: Databricks is integrating with Atlassian Rovo for natural language queries on enterprise data and partnering with Algonomy to deliver RetailAI for agentic retail planning, aiming to democratize data access and optimize operations. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI code editor optimizes token usage with dynamic context</strong>: Cursor, an AI code editor, introduced dynamic context discovery to reduce LLM token consumption by 46.9% by accessing code context only when needed, aiming for lower operational costs and faster AI response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Compute Runtime adds support for new GPUs</strong>: Intel’s Compute Runtime version 26.01.36711.4 introduces initial support for Crescent Island and Nova Lake S graphics hardware, continuing Level Zero and OpenCL API support for GPUs back to Tiger Lake. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 enhances video playback and privacy</strong>: Firefox 147 introduces automatic Picture-in-Picture video playback, reorganized tab settings, enhanced WebGPU support for Apple Silicon, zero-copy hardware video playback for AMD GPUs on PC, and improved privacy features like Google Safe Browsing v5 and tightened Tracking Protection. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New Rails engine monitors LLM API usage and costs</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and error rates within applications, providing a dashboard and configurable alerts for cost ceilings or performance degradation. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: the new shadow IT, but with more ‘autonomy’</strong>: Apparently, ‘agentic AI’ is the new buzzword for autonomous systems that handle complex workflows, web browsing, and software management with ‘limited supervision.’ This means developers are now relegated to ‘architecture, verification, and high-level orchestration.’ So, instead of fixing the underlying issues, we’re just adding another layer of ‘junior partners’ that need constant babysitting, complete with prompt injection and data poisoning risks. What could possibly go wrong when we give these ‘junior partners’ expansive access? <a href="https://app.daily.dev/feed-by-ids?id=GMZHoSF60&amp;id=Jj0H2b0XQ&amp;id=SMEJx6ENk&amp;id=Z1R08OC6I&amp;id=ZBZXWSG4p&amp;id=ZsPWeN0Lt&amp;id=dl9u8nkjK&amp;id=Qb5ngrz3J&amp;id=rN9O2D75a&amp;id=6sWfFYM3R" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated books: the new frontier of technical ‘knowledge’</strong>: HiTeX Press has apparently mastered the art of industrial-scale spam, releasing over 800 AI-generated technical books in a single year. These masterpieces feature ‘fabricated code examples’ and ‘non-existent programming features,’ all under two pseudonymous authors. Because nothing says ‘expert knowledge’ like meaningless content and unreliable information, now widely available on Amazon. Good luck distinguishing actual expertise from this digital landfill. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>LLM coding tools: still not replacing senior engineers (surprise!)</strong>: Senior developers are still pointing out that LLM agentic coding tools are ‘slow, requiring significant supervision, and not markedly improving productivity for experienced programmers.’ While they might help junior devs or non-coders, AI-generated Kotlin code for Android is ‘functionally correct but architecturally deficient,’ mishandling coroutines and lifecycle management. So, despite the hype, it seems the ‘senior engineer’ role is safe for now, mostly because someone still needs to clean up the AI’s mess. <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
