<h2>Must know</h2>
<ul>
<li><strong>Critical AI agent vulnerability in ServiceNow exposed</strong>: A critical vulnerability, CVE-2025-12420 (BodySnatcher), was found in ServiceNow’s Virtual Agent AI platform, allowing unauthenticated attackers to impersonate any user with just an email address. This flaw, confirmed by AppOmni and ServiceNow, bypassed MFA and passwords, enabling privilege escalation and access to connected modules. While no active exploitation was detected, the incident highlights the significant security risks of rapidly integrating AI agents with broad access, as noted by both AppOmni and ServiceNow. Patches and mitigations have been issued promptly. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js DoS vulnerability impacts major frameworks</strong>: Node.js disclosed CVE-2025-59466, a critical denial-of-service vulnerability affecting versions 8.x through 24.x. This flaw causes process crashes if <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled, impacting major frameworks like Next.js and React Server Components, as well as APM tools like Datadog. Patches have been released for supported versions, and immediate upgrades are recommended to prevent server termination and service downtime, according to Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>U.S. federal agencies gear up for quantum security migration</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to active implementation of post-quantum cryptography (PQC) to counter ‘harvest now, decrypt later’ threats. NIST has finalized initial PQC standards, urging agencies to inventory cryptographic assets and adopt hybrid solutions. This multi-year effort, detailed at the YQS2026 event, emphasizes securing supply chains and research against foreign interference, highlighting quantum security as an urgent, present necessity. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI agent architectures: choosing the right pattern</strong>: Multi-agent architectures are essential when single agents hit context or development limits, with patterns like subagents, skills, handoffs, and routers offering distinct tradeoffs in latency, token usage, and parallelization, as discussed by LangChain. <a href="https://app.daily.dev/posts/Qb5ngrz3J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor code editor optimizes AI token usage</strong>: Cursor, an AI code editor, introduced dynamic context discovery to reduce LLM token consumption by 46.9% by accessing code context only when needed, aiming for faster AI response times and lower operational costs. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks expands AI partnerships for data insights</strong>: Databricks is partnering with Atlassian Rovo for natural language queries on enterprise data and Algonomy for AI-driven retail planning, aiming to democratize data access and move businesses towards predictive operations. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub releases open-source framework for AI security research</strong>: GitHub Security Lab launched Taskflow Agent, an open-source framework using AI and natural language to automate security research, allowing collaboration on YAML-based taskflows for vulnerability analysis. <a href="https://app.daily.dev/posts/zVkqeCNSc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine monitors LLM API usage and costs</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and errors within applications, providing a dashboard and configurable alerts for cost optimization and performance management. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel adds support for new GPUs in Compute Runtime</strong>: Intel’s Compute Runtime version 26.01.36711.4 introduces initial support for Crescent Island and Nova Lake S graphics hardware, continuing Level Zero and OpenCL API support for GPUs back to Tiger Lake. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Thunderbird 147 released</strong>: Firefox 147 introduces automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU for Apple Silicon, and zero-copy hardware video playback for AMD GPUs, while Thunderbird 147 adds a ‘Show Full Path’ option and optional folder-name localization. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: the new junior devs who need constant supervision</strong>: Apparently, autonomous AI agents are being reframed as systems that can handle complex workflows with ‘limited supervision,’ shifting developers’ roles to ‘architecture, verification, and high-level orchestration.’ The consensus from industry leaders and practitioners is to treat them as ‘junior partners needing supervision,’ not magical solutions. So, we’re just building more junior developers, but this time they’re made of code and prone to ‘prompt injection and data poisoning.’ Progress! <a href="https://app.daily.dev/feed-by-ids?id=GMZHoSF60&amp;id=Jj0H2b0XQ&amp;id=SMEJx6ENk&amp;id=Z1R08OC6I&amp;id=ZBZXWSG4p&amp;id=ZsPWeN0Lt&amp;id=dl9u8nkjK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated books: because quality control is for suckers</strong>: HiTeX Press has managed to churn out over 800 ‘technical books’ in a single year, all ‘entirely by AI without human oversight.’ These masterpieces feature ‘fabricated code examples’ and ‘non-existent programming features,’ making them ‘often meaningless.’ But hey, they’re only 8€ each on Amazon, so who needs reliable information when you can have industrial-level spam polluting the technical publishing landscape? <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-driven API requests: what could possibly go wrong?</strong>: Nordic APIs is here to remind us that letting AI agents make API requests introduces ‘six major risks,’ including ‘runaway costs,’ ‘hallucinated contract calls,’ and ‘fragile authorization.’ Apparently, LLMs lack ‘understanding of authorization boundaries,’ which is shocking, given their probabilistic nature. So, we’re building systems that can’t be trusted with basic security, but don’t worry, ‘supervised execution architectures’ and ‘strict validation’ will save us. Sure. <a href="https://app.daily.dev/posts/K1eLIzPoy" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
