<h2>Must know</h2>
<ul>
<li><strong>Critical Node.js vulnerability impacts major frameworks and APM tools</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js, affecting versions 8.x through 24.x, causes process crashes when <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled. This impacts widely used frameworks like Next.js and React Server Components, as well as APM tools such as Datadog, New Relic, and OpenTelemetry. Node.js has released patches for supported versions, and immediate upgrades are crucial to prevent server termination and service downtime, as confirmed by Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full user impersonation</strong>: AppOmni and ServiceNow confirmed a critical vulnerability (CVE-2025-12420) in ServiceNow’s Virtual Agent AI platform, allowing unauthenticated attackers to impersonate any user with just an email address. This flaw bypassed password and MFA, enabling privilege escalation across connected modules and the creation of rogue AI agents. While no active exploitation was found, the incident highlights the systemic risks of integrating AI agents with expansive access, as noted by both AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday addresses critical zero-day and Secure Boot flaws</strong>: Microsoft’s January 2026 Patch Tuesday includes fixes for 112-114 vulnerabilities, with eight critical ones. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR, increasing risk in exploit chains. CISA has added this to its Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026. Additionally, patches address certificate expiration issues in Secure Boot from 2011 and upcoming 2026 expirations, as reported by Krebs on Security and The Hacker News. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cursor AI editor optimizes token usage with dynamic context discovery</strong>: Cursor, an AI code editor, introduced dynamic context discovery, reducing LLM token consumption by 46.9% by allowing AI agents to access code context only when needed, which should lower operational costs and improve response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Atlassian Rovo integrates with Databricks AI/BI Genie for natural language queries</strong>: Atlassian Rovo now integrates with Databricks AI/BI Genie, enabling users to query enterprise data in plain English and receive real-time insights without needing SQL expertise, aiming to democratize data access. <a href="https://app.daily.dev/posts/2XKWuVI4o" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine launched for LLM API monitoring and cost management</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and errors within Rails applications, offering a dashboard and configurable alerts for cost optimization and performance monitoring. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 enhances video playback and privacy features</strong>: Firefox 147 introduces automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU support for Apple Silicon, zero-copy hardware video playback for AMD GPUs on PC, and improved privacy with Google Safe Browsing v5 and tightened tracking protection. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Compute Runtime adds support for new Crescent Island and Nova Lake S GPUs</strong>: Intel’s Compute Runtime version 26.01.36711.4 now includes initial support for Crescent Island and Nova Lake S graphics hardware, continuing Level Zero and OpenCL API support for GPUs back to Tiger Lake. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Laravel Boost v1.8.10 introduces AI-assisted prompts</strong>: Laravel Boost v1.8.10 now includes AI-powered prompts for code simplification, inspired by the Claude plugin, and an upgrade assistant specifically for Livewire v4 migrations, with no breaking changes. <a href="https://app.daily.dev/posts/TQr7IJii0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>U.S. federal agencies begin quantum security preparations</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to implementation of quantum security practices, focusing on mandatory cryptographic migration to counter ‘harvest now, decrypt later’ attacks. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: the new bottleneck is deciding what not to build</strong>: Apparently, AI-powered coding agents are so good they’ve shifted the bottleneck from writing code to defining requirements. InfoWorld suggests developers will now spend more time reviewing and refactoring AI output, and product managers will need to be even better at filtering ideas. So, we’re just moving the goalposts, making it easier to churn out more mediocre software faster, and calling it progress. Fantastic. <a href="https://app.daily.dev/posts/H430dwVHX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated technical books: because we needed more garbage</strong>: HiTeX Press has managed to release over 800 AI-generated technical books in a single year, complete with fabricated code and non-existent features, all sold on major platforms like Amazon. This industrial-scale spam operation is polluting the technical publishing landscape, making it harder for actual learners to find reliable information. It’s almost as if the race to automate everything means we’re just automating the production of utter nonsense. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quantum cameras: 20x resolution, 1000x faster, zero independent verification</strong>: Diffraqtion, an MIT spinout, claims its new quantum camera technology offers 20 times higher resolution and 1,000 times faster processing for satellites. These numbers are, of course, directly from the company and award organizations, with no independent verification. It’s always great to see such groundbreaking advancements, especially when they come with such precise, unverified metrics. Just trust them, it’s quantum! <a href="https://app.daily.dev/posts/A9H2rpmDZ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
