<h2>Must know</h2>
<ul>
<li><strong>AI agents are still a mess, but getting better</strong>: Critical vulnerabilities were found in ServiceNow’s Virtual Agent and Superhuman AI, allowing full system control and email exfiltration respectively. These issues highlight the risks of weak authentication and insecure integration of agentic AI, as reported by security researchers. Meanwhile, Google’s Conductor aims to fix context loss in AI-assisted development by using persistent Markdown files, and LangGrant’s LEDGE MCP Server promises to enable safe enterprise analytics for LLMs by using metadata instead of raw data, according to InfoQ. It seems everyone is still figuring out how to make these things work without breaking everything. <a href="https://app.daily.dev/feed-by-ids?id=wzAqd15ET&amp;id=G7pZqTe0S&amp;id=jaKSkIh92&amp;id=rAHVvRPEj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js gets critical security updates</strong>: Node.js released versions 20.20.0 (LTS) and 25.3.0 (Current) with security fixes for multiple CVEs, including a denial-of-service vulnerability from stack space exhaustion impacting async_hooks and React Server Components. These updates address issues like default error handlers for TLSSocket, stricter symlink permissions, and proper handling of stack overflow exceptions, as detailed in the official Node.js disclosures. Developers using Node.js 20.20.0+, 22.22.0+, 24.13.0+, or 25.3.0+ should update immediately.</li>
<li><strong>Microsoft patches actively exploited Windows 0-day</strong>: Microsoft issued a critical patch for CVE-2026-20805, an actively exploited information disclosure vulnerability in Windows that could lead to ASLR bypass. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies patch this flaw by February 3rd, emphasizing its immediate risk. This is part of Microsoft’s January 2026 Patch Tuesday, which also addressed 112 other CVEs, including several critical remote code execution flaws in Office.</li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Google Gemini 3 pushes multimodal AI and agentic coding</strong>: Google Gemini 3 introduces a unified multimodal AI platform, including Gemini 3 Pro with a 1M+ token context window for agentic coding and a ‘Deep Think’ mode for complex reasoning, aiming to streamline workflows for developers. <a href="https://app.daily.dev/posts/LKHPrKtZP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Convex offers a new approach to application databases</strong>: Convex provides a TypeScript-first application database where all state lives in code, offering automatic type safety, real-time sync, and intelligent caching, making it particularly useful for AI agent development.</li>
<li><strong>Advanced Linux malware targets cloud and containers</strong>: Check Point Research identified VoidLink, an advanced malware framework written in Zig, designed to target Linux cloud and container environments like Docker and Kubernetes, featuring 37+ modular plugins for credential harvesting and evasion.</li>
<li><strong>Apple launches Creator Studio subscription bundle</strong>: Apple announced Creator Studio, a $12.99/month subscription bundle for creative apps like Final Cut Pro and Logic Pro, with AI-powered features such as Transcript Search and Beat Detection, targeting creative professionals and students.</li>
<li><strong>Rust gains traction in embedded smart door locks</strong>: Achilles has been using Rust for 4-5 years in production for smart door lock firmware, citing its safety features and efficient code size, with a single firmware engineer managing 25,000 deployed devices thanks to open-source collaboration and tools like the Embassy async runtime.</li>
<li><strong>Astro 6 Beta brings Cloudflare Workers support</strong>: Astro 6 Beta was released with a redesigned development server, full support for Cloudflare Workers, stable content collections for real-time data updates, and improved Content Security Policy support, requiring Node.js 22 or newer.</li>
<li><strong>Bifrost offers a faster LLM gateway</strong>: Bifrost, an open-source LLM gateway written in Go, provides unified access to 15+ AI providers with 40x lower overhead and 68% lower memory usage compared to LiteLLM, featuring semantic caching, failover, and load balancing for production AI systems.</li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Meta’s AI leadership drama and book spam</strong>: Yann LeCun, Meta’s former chief AI scientist, apparently stormed off after Alexander Wang, CEO of Scale AI, was appointed head of superintelligence, with LeCun publicly calling Wang ‘inexperienced’ and alleging manipulation of Llama 4 test results. Meanwhile, HiTeX Press has published over 800 AI-generated technical books in a year, full of fabricated code and features, selling them for 8€ a pop on Amazon. It seems Meta’s internal AI drama is as real as the ‘facts’ in those AI-generated books.</li>
<li><strong>Microsoft’s ‘community-first’ AI data centers: greenwashing or genuine change?</strong>: Microsoft, facing massive public backlash over its energy-hungry AI data centers, has suddenly announced a ‘community-first’ approach, promising to pay full electricity costs, minimize water use, and create local jobs. This comes after withdrawing from a Wisconsin project due to opposition and ongoing resistance elsewhere. It’s almost as if they realized that destroying local grids and water supplies for AI isn’t a great look, and now they’re trying to greenwash their way out of it.</li>
<li><strong>Anthropic’s $1.5 million for Python security: a drop in the bucket or a genuine effort?</strong>: Anthropic, a company that probably uses Python for everything, is pledging a whopping $1.5 million over two years to the Python Software Foundation for open-source security. They’re focusing on CPython and PyPI, which is great, but let’s be real: $1.5 million for an entire ecosystem that underpins countless critical systems, including their own, feels a bit like a rounding error for a company valued in the billions. Still, better than nothing, I suppose, especially if it helps them avoid their own supply-chain attacks.</li>
</ul>
