<h2>Must know</h2>
<ul>
<li><strong>Critical vulnerabilities hit Node.js and ServiceNow AI</strong>: Node.js disclosed a critical denial-of-service vulnerability (CVE-2025-59466) affecting versions 8.x through 24.x, which can crash servers using <code>async_hooks</code> or <code>AsyncLocalStorage</code>. Patches have been released, and major frameworks like Next.js and React Server Components are impacted, as confirmed by Node.js release notes and Datadog. Separately, ServiceNow’s Virtual Agent AI platform had a critical flaw (CVE-2025-12420) allowing unauthenticated attackers to impersonate any user, bypassing MFA, according to AppOmni and ServiceNow. This highlights the growing security risks with AI agent integration. <a href="https://app.daily.dev/feed-by-ids?id=EyLXGRUe2&amp;id=wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday addresses critical zero-day</strong>: Microsoft released its January 2026 Patch Tuesday updates, fixing 112-114 vulnerabilities, including eight critical ones. A zero-day vulnerability (CVE-2026-20805) in Desktop Window Manager is actively exploited to bypass ASLR, leaking memory addresses. CISA has added this to its Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026, as reported by Krebs on Security and The Hacker News. This vulnerability requires local access but significantly increases risk in exploit chains. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>US federal agencies ramp up quantum security efforts</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to implementation of quantum security practices. The focus is on mitigating ‘harvest now, decrypt later’ attacks by migrating to post-quantum cryptography (PQC) standards finalized by NIST. This multi-year effort requires immediate inventory of cryptographic assets and the adoption of hybrid solutions, emphasizing quantum security as a present and future necessity, according to statements from these agencies. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Bandcamp bans substantially AI-generated music</strong>: Bandcamp has announced a ban on music and audio created wholly or substantially by AI, effective January 2026, to protect human artists and ensure authenticity, diverging from platforms like Spotify. <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 brings picture-in-picture and security fixes</strong>: Firefox 147 is out with automatic Picture-in-Picture video playback, reorganized tab settings, enhanced WebGPU support for Apple Silicon, and zero-copy hardware video playback for AMD GPUs on PC, alongside multiple security fixes. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks partners for AI-driven data insights and retail solutions</strong>: Databricks is expanding its AI capabilities through partnerships with Atlassian Rovo for natural language queries on enterprise data and Algonomy for AI-driven retail planning solutions, aiming to democratize data access and optimize retail operations. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor code editor optimizes AI token usage</strong>: Cursor, an AI code editor, introduced dynamic context discovery to reduce LLM token consumption by 46.9% by accessing code context only when needed, aiming for faster AI response times and lower operational costs. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Compute Runtime adds new GPU support</strong>: Intel’s Compute Runtime version 26.01.36711.4 now includes initial support for Crescent Island and Nova Lake S graphics hardware, continuing support for Level Zero and OpenCL APIs. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quantum dot breakthrough for telecom C-band</strong>: Researchers developed a single-photon source using InAs quantum dots operating in the telecom C-band, achieving 91.7% two-photon interference visibility, a record for solid-state sources in this range, potentially enabling practical quantum networks. <a href="https://app.daily.dev/posts/woujp8xYd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine monitors LLM API usage and costs</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and error rates within Rails applications, providing a dashboard and configurable alerts for cost management and optimization. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated books: the new spam</strong>: Apparently, HiTeX Press has managed to churn out over 800 ‘technical’ books in a single year, all entirely AI-generated and devoid of human oversight. These masterpieces, available on major platforms like Amazon for a mere 8€, are filled with fabricated code and non-existent features, making them utterly useless. It’s a spam factory, polluting the technical publishing landscape and making it even harder to find actual useful information, as one investigation highlighted. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents: still not senior engineers, but great for debugging Sentry</strong>: Turns out, Claude Opus 4.5 is fantastic at debugging Sentry integrations and AWS ECS migrations, but don’t expect it to come up with innovative engineering solutions or replace your senior staff. The ‘Claude is not a senior engineer (yet)’ article points out that these ‘autonomous’ systems are really just amplifying well-designed infrastructure, not creating it. So, we’re still stuck with the human element for anything that requires actual judgment or abstraction, which is, you know, most of engineering. <a href="https://app.daily.dev/feed-by-ids?id=GMZHoSF60&amp;id=Jj0H2b0XQ&amp;id=SMEJx6ENk&amp;id=Z1R08OC6I&amp;id=ZBZXWSG4p&amp;id=ZsPWeN0Lt&amp;id=dl9u8nkjK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>LLM coding tools: great for juniors, a drag for seniors</strong>: Senior developers are apparently finding LLM agentic coding tools to be slow, demanding constant supervision, and not actually boosting their productivity. While they might be useful for documentation lookups or getting less experienced folks started, the ‘Insecure Evangelism of LLM Maximalists’ article suggests that the hype around these tools for seasoned pros is just that—hype. It seems the AI-generated Kotlin code, while functional, is architecturally unsound, leading to more work for the humans who have to clean up the mess. <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
