<h2>Must know</h2>
<ul>
<li><strong>Node.js DoS vulnerability impacts major frameworks</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js affects versions 8.x through 24.x, causing process crashes if <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled. This impacts major frameworks like Next.js and React Server Components, as well as APM tools such as Datadog, New Relic, and OpenTelemetry. Node.js has released patches for supported versions, and immediate upgrades are recommended to prevent server termination and service downtime, as confirmed by Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical AI agent authentication flaw in ServiceNow</strong>: ServiceNow’s Virtual Agent AI platform had a critical vulnerability (CVE-2025-12420, aka BodySnatcher) that allowed unauthenticated attackers to impersonate any user with just an email address, bypassing passwords and MFA. This flaw, rooted in weak authentication combined with new AI capabilities, could enable attackers to create admin accounts, access connected modules, and escalate privileges. Both AppOmni and ServiceNow confirmed the issue, with ServiceNow promptly issuing a patch and removing the exploited AI agent functionality, highlighting the risks of rapidly integrating AI agents without robust security controls. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday brings critical security updates</strong>: Microsoft released its January 2026 Patch Tuesday updates, addressing over 112 vulnerabilities, including eight critical ones. A zero-day vulnerability (CVE-2026-20805) in Desktop Window Manager, actively exploited in the wild to bypass ASLR, has been added to CISA’s Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026. Other fixes include multiple Office RCE vulnerabilities and patches for Secure Boot certificate expiration issues, as reported by Krebs on Security and BleepingComputer. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>New Linux malware targets cloud environments</strong>: Security researchers discovered VoidLink, a sophisticated Linux malware framework with over 30 modules for reconnaissance and lateral movement, specifically targeting cloud environments like AWS, GCP, Azure, Alibaba, and Tencent by detecting hosting platforms through vendor APIs. <a href="https://app.daily.dev/posts/x9wl564Rc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pulumi IAM now available for self-hosted cloud</strong>: Pulumi IAM, featuring Custom Roles and scoped Access Tokens, is now available for self-hosted Pulumi Cloud instances, enabling organizations to define fine-grained permissions and implement Zero Trust security for CI/CD automation. <a href="https://app.daily.dev/posts/wd03nDp6A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open-source project management tool Plane offers Jira alternative</strong>: Plane is a free, open-source project management tool that can be self-hosted via Docker, offering features like issues, epics, cycles, analytics, and AI integration for summarizing work, positioning itself as an alternative to Jira and Linear. <a href="https://app.daily.dev/posts/Hng4rFIwx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI code editor optimizes token usage</strong>: Cursor, an AI code editor, introduced dynamic context discovery to optimize LLM token usage by accessing code context only when needed, reducing token consumption by 46.9% and potentially lowering operational costs and improving AI response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Compute Runtime adds new GPU support</strong>: Intel released Compute Runtime version 26.01.36711.4, introducing initial support for Crescent Island and Nova Lake S graphics hardware while maintaining Level Zero and OpenCL API support. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Thunderbird 147 released</strong>: Firefox 147 introduces automatic Picture-in-Picture video playback, reorganized tab settings, enhanced WebGPU support for Apple Silicon, and zero-copy hardware video playback for AMD GPUs on PC, while Thunderbird 147 adds a ‘Show Full Path’ option and optional folder-name localization. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine for LLM API monitoring launched</strong>: RubyLLM::Monitoring is a new Rails engine designed to track LLM API usage, cost, performance, and error rates within Rails applications, providing a dashboard and configurable alerts for cost ceilings or performance degradation. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: the new junior dev that needs constant supervision</strong>: Apparently, agentic AI is being reframed as autonomous systems that can handle complex workflows with limited supervision, shifting developers’ roles towards architecture and verification. However, the consensus from actual engineers is that these AI agents are more like junior partners needing constant oversight, especially given the security challenges like prompt injection and data poisoning. So, while they might amplify well-designed infrastructure, don’t expect them to replace your senior engineers or magically fix your messy code, as one practitioner bluntly put it. <a href="https://app.daily.dev/feed-by-ids?id=GMZHoSF60&amp;id=Jj0H2b0XQ&amp;id=SMEJx6ENk&amp;id=Z1R08OC6I&amp;id=ZBZXWSG4p&amp;id=ZsPWeN0Lt&amp;id=dl9u8nkjK&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated books: the new frontier of technical spam</strong>: HiTeX Press has apparently managed to release over 800 technical books in a single year, all generated entirely by AI without human oversight. These masterpieces contain fabricated code examples and describe non-existent programming features, making them utterly useless for anyone actually trying to learn something. It’s an industrial-level spam operation polluting major platforms like Amazon, proving that if you give AI enough rope, it’ll hang the entire technical publishing industry. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quantum cameras: 20x resolution, 1000x faster, zero independent verification</strong>: Diffraqtion, a spinout from MIT and the University of Maryland, is claiming their new quantum camera technology offers 20 times higher resolution and 1,000 times faster processing for satellite and telescope constellations. These impressive numbers, conveniently provided by the company itself, are meant to enable breakthroughs in space domain awareness and defense. While they’ve won some awards, there’s no independent verification of these claims, so we’ll just have to take their word for it until someone actually tests this magical device. <a href="https://app.daily.dev/feed-by-ids?id=A9H2rpmDZ&amp;id=NhGwNaYRA&amp;id=isGrxmwaT&amp;id=wjXnstnI7" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
