<h2>Must know</h2>
<ul>
<li><strong>Critical Node.js DoS vulnerability impacts major frameworks</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js, affecting versions 8.x through 24.x, can crash applications using <code>async_hooks</code> or <code>AsyncLocalStorage</code>. This impacts major frameworks like Next.js and React Server Components, as well as APM tools such as Datadog and OpenTelemetry, as reported by Node.js release notes and Datadog. Patches have been released for supported versions, and immediate upgrades are crucial to prevent server termination and service downtime. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday addresses critical zero-day and Secure Boot flaws</strong>: Microsoft’s January 2026 Patch Tuesday includes fixes for 112-114 vulnerabilities, with eight critical ones. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR, as highlighted by Krebs on Security and BleepingComputer. The update also addresses certificate expiration issues in Secure Boot from 2011 and upcoming 2026 expirations, emphasizing the need for urgent patching to prevent boot process compromises. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full user impersonation</strong>: AppOmni and ServiceNow confirmed a critical vulnerability (CVE-2025-12420) in ServiceNow’s Virtual Agent AI platform. This flaw allowed unauthenticated attackers to impersonate any user with just an email address, bypassing passwords and MFA. The exploit could lead to admin account creation, access to connected modules, and privilege escalation, underscoring the systemic risks of rapidly integrating AI agents without robust security controls. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>OpenJDK performance fix for CPU time retrieval</strong>: A 40-line fix in OpenJDK dramatically reduced CPU time retrieval latency by 400x, replacing slow <code>/proc</code> file parsing with a single <code>clock_gettime()</code> syscall, demonstrating significant performance gains from understanding kernel internals. <a href="https://app.daily.dev/posts/kNJx43Zh3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>U.S. federal agencies prepare for quantum security migration</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to implementation of post-quantum cryptography (PQC) standards to counter ‘harvest now, decrypt later’ threats, urging immediate inventory of cryptographic assets and adoption of hybrid solutions. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI code editor optimizes token usage</strong>: Cursor, an AI code editor, introduced dynamic context discovery to reduce LLM token consumption by 46.9% by accessing code context only when needed, aiming for lower operational costs and faster AI response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Compute Runtime adds new GPU support</strong>: Intel released Compute Runtime version 26.01.36711.4, introducing initial support for Crescent Island and Nova Lake S graphics hardware while maintaining Level Zero and OpenCL API compatibility. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Thunderbird 147 released</strong>: Firefox 147 introduces automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU support for Apple Silicon, and zero-copy hardware video playback for AMD GPUs, while Thunderbird 147 adds a ‘Show Full Path’ option and optional folder-name localization. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine for LLM API monitoring launched</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, cost, performance, and error rates with a built-in dashboard and configurable alerts, helping developers manage and optimize LLM expenses. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks expands AI partnerships for data insights</strong>: Databricks is partnering with Atlassian Rovo for natural language queries on enterprise data and Algonomy for AI-driven retail planning solutions, aiming to democratize data access and move businesses towards predictive operations. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated books: the new spam</strong>: Apparently, HiTeX Press has managed to churn out over 800 technical books in a single year, all ‘created entirely by AI without human oversight.’ These masterpieces, available on major platforms like Amazon, are reportedly filled with ‘fabricated code examples’ and ‘non-existent programming features.’ So, if you’re looking for reliable technical knowledge, maybe don’t trust the AI that can’t even get Starlark right. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding tools: still not senior engineers</strong>: Senior developers are still scratching their heads over the supposed productivity gains from LLM-based coding tools, finding them ‘slow, requiring significant supervision, and not markedly improving productivity.’ While some claim AI ‘improves development speed and client project throughput,’ others report AI-generated code is ‘functionally correct but architecturally deficient,’ mishandling everything from coroutines to memory management. So, it seems we’re still stuck reviewing AI’s homework rather than letting it run the show. <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents: the new insider threat</strong>: Just when you thought you had a handle on cybersecurity, AI agents are now being flagged as ‘insider threats,’ susceptible to prompt injection and even capable of compromising physical robots via voice commands. Researchers are showing how ‘compromised humanoid robots can propagate attacks to nearby devices.’ So, while we’re busy patching Windows, our AI ‘junior partners’ might be busy turning our smart homes into a botnet. Good times. <a href="https://app.daily.dev/feed-by-ids?id=MpJOJGOmA&amp;id=bwVFAnzEc&amp;id=c8Xk5dH7c" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
