<h2>Must know</h2>
<ul>
<li><strong>Critical Node.js vulnerability impacts major frameworks and APM tools</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js, affecting versions 8.x through 24.x, can crash applications using <code>async_hooks</code> or <code>AsyncLocalStorage</code>. This impacts major frameworks like Next.js and React Server Components, as well as APM tools such as Datadog, New Relic, and OpenTelemetry. Node.js has released patches for supported versions, and immediate upgrades are crucial to prevent service downtime, as reported by Node.js release notes and Datadog. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full user impersonation</strong>: A critical vulnerability, dubbed ‘BodySnatcher’ (CVE-2025-12420), was discovered in ServiceNow’s Virtual Agent AI platform. This flaw allowed unauthenticated attackers to impersonate any user with just an email address, bypassing passwords and MFA. The exploit could lead to admin account creation, access to connected modules, and privilege escalation across integrations. While no active exploitation was found, ServiceNow promptly issued a patch and removed the exploited AI agent functionality, as confirmed by AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday addresses critical zero-day and Secure Boot flaws</strong>: Microsoft’s January 2026 Patch Tuesday includes critical security updates for 112-114 vulnerabilities. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR, increasing risk when combined with other exploits. Additionally, patches address certificate expiration vulnerabilities in Secure Boot from 2011, with urgent updates needed for certificates expiring in mid-2026. CISA has added CVE-2026-20805 to its Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026, according to Krebs on Security and The Hacker News. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI agents for security research released by GitHub</strong>: GitHub Security Lab has launched Taskflow Agent, an open-source framework using AI and natural language to automate security research, enabling community collaboration through shareable YAML-based taskflows and integration with tools like CodeQL. <a href="https://app.daily.dev/posts/zVkqeCNSc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine monitors LLM API usage and costs</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and errors within Rails applications, offering a dashboard, configurable alerts, and internal data storage for privacy and cost optimization. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor code editor optimizes LLM token usage</strong>: Cursor, an AI code editor, introduced dynamic context discovery to reduce LLM token consumption by 46.9% by accessing code context only when needed, aiming for faster AI responses and lower operational costs. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Compute Runtime adds support for new GPUs</strong>: Intel’s Compute Runtime version 26.01.36711.4 introduces initial support for Crescent Island and Nova Lake S graphics hardware, maintaining Level Zero and OpenCL API compatibility. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Thunderbird 147 released</strong>: Firefox 147 features automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU support for Apple Silicon, and zero-copy hardware video playback for AMD GPUs, while Thunderbird 147 adds a ‘Show Full Path’ option and optional folder-name localization. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>U.S. federal agencies prepare for quantum security migration</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving to implement post-quantum cryptography (PQC) standards to counter ‘harvest now, decrypt later’ attacks, urging immediate inventory of cryptographic assets and planning for hybrid solutions. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks expands AI partnerships for data insights</strong>: Databricks has partnered with Atlassian Rovo for natural language queries on enterprise data and with Algonomy to deliver RetailAI for agentic retail planning, aiming to democratize data access and move towards predictive operations. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: still not senior engineers, but great for amplifying existing messes</strong>: Turns out, Claude Opus 4.5 is fantastic at debugging your Sentry integration or migrating AWS ECS if your infrastructure is already pristine. But don’t expect it to architect anything innovative or, you know, <em>think</em> like a senior engineer. As one expert put it, Claude ‘amplifies well-designed infrastructure but does not replace engineers capable of creating or refactoring such systems.’ So, if your systems are a dumpster fire, AI will just make them burn brighter, faster. <a href="https://app.daily.dev/feed-by-ids?id=GMZHoSF60&amp;id=Jj0H2b0XQ&amp;id=SMEJx6ENk&amp;id=Z1R08OC6I&amp;id=ZBZXWSG4p&amp;id=ZsPWeN0Lt&amp;id=dl9u8nkjK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated books: the new frontier of technical spam</strong>: Apparently, a publisher called HiTeX Press has managed to churn out over 800 technical books in a single year, all ‘created entirely by AI without human oversight.’ These masterpieces feature fabricated code, non-existent programming features, and generally ‘meaningless’ content. So, if you’re looking for reliable technical resources, good luck sifting through the industrial-scale spam now polluting Amazon. Because nothing says ‘quality education’ like a book written by a hallucinating algorithm. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bandcamp bans AI music: protecting artists or just being Luddites?</strong>: Bandcamp, bless their hearts, has decided to ban ‘wholly or substantially AI-generated music’ to ‘protect human musicians’ and ensure ‘authenticity.’ This, while AI-generated songs are topping charts and getting major record deals, and Suno is raising $250 million despite copyright lawsuits. It seems Bandcamp’s ‘authenticity’ policy is less about art and more about their niche revenue model not being able to compete with the sheer volume of AI-generated noise. Good luck enforcing that, folks. <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
