<h2>Must know</h2>
<ul>
<li><strong>OpenJDK gets a 400x performance boost for thread monitoring</strong>: A recent OpenJDK commit dramatically improved thread CPU time monitoring on Linux, achieving a 400x performance gain. The fix, detailed on Hacker News and Inside Java, replaces slow /proc file parsing with a single, optimized <code>clock_gettime()</code> syscall. This change reduces latency from 11μs to 279ns, making fine-grained CPU profiling practical for high-throughput Java applications that previously had to disable this feature due to overhead. <a href="https://app.daily.dev/feed-by-ids?id=kNJx43Zh3&amp;id=knpVKAEx9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical DoS vulnerability in Node.js async_hooks impacts major frameworks</strong>: Node.js disclosed a critical denial-of-service vulnerability (CVE-2025-59466) affecting versions 8.x through 24.x. This flaw causes process crashes if <code>async_hooks</code> or <code>AsyncLocalStorage</code> is enabled, impacting major frameworks like Next.js and React Server Components, as well as APM tools like Datadog. Node.js has released patches for supported versions, and immediate upgrades are recommended to prevent server termination and service downtime. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday delivers critical security updates</strong>: Microsoft released its January 2026 Patch Tuesday updates, addressing over 112 vulnerabilities, including eight critical flaws. A zero-day vulnerability (CVE-2026-20805) in Desktop Window Manager, actively exploited in the wild to bypass ASLR, has been added to CISA’s Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026. The updates also include fixes for Office RCEs and Secure Boot certificate expirations, as reported by Krebs on Security and BleepingComputer. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cursor AI editor optimizes token usage with dynamic context discovery</strong>: Cursor, an AI code editor, introduced dynamic context discovery, reducing LLM token consumption by 46.9% by allowing AI agents to retrieve code context on-demand, which lowers operational costs and improves response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub Security Lab releases AI-powered security research framework</strong>: GitHub Security Lab launched Taskflow Agent, an open-source framework that uses AI and natural language to automate security research, enabling community collaboration through YAML-based taskflows and Model Context Protocol (MCP) interfaces. <a href="https://app.daily.dev/posts/zVkqeCNSc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks and Atlassian Rovo partner for conversational data insights</strong>: Atlassian Rovo now integrates with Databricks AI/BI Genie, allowing users to query enterprise data in plain English and receive real-time insights without SQL expertise, democratizing data access and reducing knowledge silos. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Thunderbird 147 released with new features</strong>: Firefox 147 introduces automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU support for Apple Silicon, and zero-copy hardware video playback for AMD GPUs, while Thunderbird 147 adds a ‘Show Full Path’ option and optional folder-name localization. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>U.S. federal agencies advance quantum security preparations</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to implementation of quantum security practices, focusing on migrating to post-quantum cryptography (PQC) to counter ‘harvest now, decrypt later’ attacks. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Compute Runtime adds support for new GPUs</strong>: Intel released Compute Runtime version 26.01.36711.4, introducing initial support for Crescent Island and Nova Lake S graphics hardware while maintaining Level Zero and OpenCL API compatibility. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine launched for LLM API monitoring</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, cost, performance, and error rates within Rails applications, providing a dashboard and configurable alerts for cost management and performance optimization. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: still not senior engineers, but great for porting code?</strong>: Apparently, AI agents are still not senior engineers, as one developer found Claude Opus 4.5 lacking in ‘senior-level judgment’ for innovative solutions. Yet, another developer successfully used AI agents to port a Rust template engine to Go in 45 minutes of active guidance and 10 hours of autonomous work. So, they can’t innovate, but they’re great at grunt work? Sounds like a typical junior dev, just without the coffee breaks. <a href="https://app.daily.dev/feed-by-ids?id=GMZHoSF60&amp;id=VOMBPE1Xs&amp;id=IcLyTC7xk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow’s ‘most severe AI vulnerability to date’ was just weak auth</strong>: ServiceNow’s Virtual Agent AI platform had a ‘critical vulnerability’ (CVE-2025-12420, aka BodySnatcher) that allowed unauthenticated attackers to impersonate any user with just an email address. ServiceNow called it the ‘Most Severe AI Vulnerability to Date,’ which is a bold claim for what sounds like a basic authentication bypass. Maybe the AI was just trying to be helpful by letting everyone in? They’ve since patched it and removed the ‘exploited AI agent functionality,’ because apparently, AI agents with weak auth are a bad idea. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated technical books: the new spam frontier</strong>: HiTeX Press has managed to release over 800 AI-generated technical books in a single year, complete with fabricated code and non-existent features, all under two pseudonymous authors. These masterpieces are being sold on major platforms like Amazon. It’s not just about bad books; it’s about polluting the technical publishing landscape with meaningless content. Because what developers really need is more unreliable information to sift through, right? <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
