<h2>Must know</h2>
<ul>
<li><strong>Node.js faces critical DoS vulnerability</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) has been discovered in Node.js, affecting versions 8.x through 24.x. This flaw causes process crashes if <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled, impacting major frameworks like Next.js and React Server Components, as well as APM tools like Datadog. Node.js has released patches for supported versions, and immediate upgrades are recommended to prevent service downtime, according to Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full impersonation</strong>: A critical vulnerability, dubbed ‘BodySnatcher’ (CVE-2025-12420), was found in ServiceNow’s Virtual Agent AI platform. This flaw allowed unauthenticated attackers to impersonate any user with just an email address, bypassing passwords and MFA. The exploit could lead to admin account creation, access to connected modules, and privilege escalation across integrations. ServiceNow has since issued a patch and removed the exploited AI agent functionality, as confirmed by AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday brings critical security updates</strong>: Microsoft’s January 2026 Patch Tuesday addresses over 112 vulnerabilities, including eight critical ones. A zero-day vulnerability (CVE-2026-20805) in Desktop Window Manager, actively exploited to bypass ASLR, has been added to CISA’s Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026. Other fixes include multiple Office RCE vulnerabilities and updates for Secure Boot certificate expirations, as reported by Krebs on Security and BleepingComputer. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Livewire 4 introduces view-based components</strong>: Laravel’s Livewire 4 now defaults to view-based components, allowing developers to co-locate PHP logic, Blade templates, and JavaScript in a single file, with full backward compatibility for class-based components. <a href="https://app.daily.dev/posts/tfldkksu3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI editor optimizes token usage</strong>: Cursor, an AI code editor, introduced dynamic context discovery to reduce LLM token consumption by 46.9% by accessing code context only when needed, aiming for faster AI responses and lower operational costs. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks expands AI partnerships for data insights</strong>: Databricks is partnering with Atlassian Rovo for natural language queries on enterprise data and Algonomy for AI-driven retail planning, aiming to democratize data access and move towards predictive operations. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 brings Picture-in-Picture and WebGPU enhancements</strong>: Firefox 147 introduces automatic Picture-in-Picture video playback, reorganized tab settings, enhanced WebGPU support for Apple Silicon, and zero-copy hardware video playback for AMD GPUs on PC. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine monitors LLM API usage and costs</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and error rates within applications, providing a dashboard and configurable alerts for cost management and optimization. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Trends and Kaggle enhance AI usability</strong>: Google Trends now integrates Gemini AI for identifying related search trends and supports up to eight simultaneous terms, while Kaggle released Community Benchmarks for custom, community-driven AI model evaluations. <a href="https://app.daily.dev/feed-by-ids?id=WhUrXR4tI&amp;id=XLEr4o2U6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>U.S. federal agencies prepare for quantum security migration</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving to implement post-quantum cryptography standards to counter ‘harvest now, decrypt later’ threats, urging immediate inventory of cryptographic assets. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding tools: still not replacing senior engineers</strong>: Apparently, some senior developers are still out there, stubbornly insisting that LLM-based coding tools are ‘slow’ and require ‘excessive oversight.’ Imagine that! While the AI maximalists are busy projecting their insecurities and dismissing skepticism, it seems these tools are great for documentation lookup and letting non-developers dabble in code. But for actual seasoned developers, the promise of prompt-driven productivity remains, shall we say, a work in progress. Who knew experience still mattered? <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bandcamp bans AI music, because authenticity is a thing</strong>: In a shocking display of common sense, Bandcamp has decided to ban music ‘wholly or substantially’ generated by AI. Their reasoning? Protecting human musicians and ensuring fans get authentic music. This, of course, flies in the face of platforms like Spotify, which are happily drowning in AI-generated tracks. It’s almost as if Bandcamp, with its direct-to-artist model, understands that some things, like art, might actually require a human touch. What a concept! <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated technical books: the new spam</strong>: Just when you thought the internet couldn’t get any worse, HiTeX Press has apparently churned out over 800 AI-generated technical books in a single year. These literary masterpieces feature fabricated code, non-existent programming features, and are generally ‘meaningless.’ But hey, they’re only 8€ each on Amazon! It’s a bold new world where technical learners get to sift through industrial-scale spam to find actual knowledge. Good luck with that. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
