<h2>Must know</h2>
<ul>
<li><strong>Node.js critical DoS vulnerability impacts major frameworks</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js affects versions 8.x through 24.x, causing process crashes if <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled. This impacts major frameworks like Next.js and React Server Components, as well as APM tools such as Datadog, New Relic, and OpenTelemetry. Node.js has released patches for supported versions, and immediate upgrades are recommended to prevent service downtime, as reported by Node.js release notes and Datadog. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full impersonation</strong>: ServiceNow’s Virtual Agent AI platform had a critical vulnerability (CVE-2025-12420, ‘BodySnatcher’) that allowed unauthenticated attackers to impersonate any user with just an email address, bypassing passwords and MFA. This flaw, rooted in weak authentication combined with new AI capabilities, could have led to admin account creation and privilege escalation across connected modules. Both AppOmni and ServiceNow confirmed the issue, which has since been patched, highlighting the systemic risks of rapidly integrating AI agents into enterprise workflows. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday addresses critical zero-day</strong>: Microsoft’s January 2026 Patch Tuesday includes fixes for 112-114 vulnerabilities, with eight critical ones. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR and leak memory addresses. CISA has added this to its Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026. This update also addresses Office RCEs and Secure Boot certificate issues, as detailed by Krebs on Security and BleepingComputer. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>U.S. federal agencies prepare for quantum security migration</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to implementation of quantum security practices, focusing on migrating to post-quantum cryptography (PQC) to counter ‘harvest now, decrypt later’ attacks. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open-source framework for LLM memory management</strong>: MemOS is a new open-source Memory Operating System for LLMs and AI agents, offering unified long-term memory management with graph-structured storage and multi-modal support, claiming significant accuracy improvements and token savings. <a href="https://app.daily.dev/posts/bjqQdB8fJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bandcamp bans substantially AI-generated music</strong>: Bandcamp has announced a ban on music and audio created wholly or substantially by AI, effective January 2026, aiming to protect human artists and ensure authenticity, a move that diverges from platforms like Spotify. <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI code editor optimizes token usage</strong>: Cursor, an AI code editor, introduced dynamic context discovery to reduce LLM token consumption by 46.9% by retrieving code context only when needed, aiming for lower costs and faster AI response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New Rails engine monitors LLM API usage and costs</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and error rates within Rails applications, providing a dashboard and configurable alerts for cost management and optimization. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Thunderbird 147 released</strong>: Firefox 147 introduces automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU support for Apple Silicon, and zero-copy hardware video playback for AMD GPUs, while Thunderbird 147 adds a ‘Show Full Path’ option and optional folder-name localization. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Compute Runtime adds new GPU support</strong>: Intel’s Compute Runtime version 26.01.36711.4 introduces initial support for Crescent Island and Nova Lake S graphics hardware, continuing support for Level Zero and OpenCL APIs. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated technical books: the new spam</strong>: HiTeX Press has apparently churned out over 800 AI-generated technical books in a year, complete with fabricated code and meaningless content, all under pseudonymous authors. These gems are being sold on major platforms like Amazon, making it harder for actual humans to find reliable information. Because nothing says ‘quality technical education’ like a book written by a bot that hallucinates code. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents: still not senior engineers, but great for junior tasks</strong>: Senior developers are still scratching their heads over LLM agentic coding tools, finding them slow and requiring too much hand-holding to boost productivity for experienced devs. While they might be great for documentation or helping less-experienced folks, AI-generated Android code, for example, is functionally correct but architecturally a mess. So, if you want your AI to write code that works but is utterly unmaintainable, you’re in luck! <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quantum cameras and IPOs: the hype train keeps rolling</strong>: Diffraqtion, a spinout, just snagged $4.2 million for a quantum camera claiming 20x higher resolution and 1,000x faster processing for satellites. Meanwhile, Project Eleven raised $20 million to ‘migrate digital asset infrastructure to post-quantum cryptography standards,’ because apparently, our current crypto is already toast. And Honeywell’s Quantinuum is eyeing an IPO that could value it at $20 billion. It’s all very exciting, but let’s see if these quantum leaps actually materialize or if it’s just a lot of zeroes on a spreadsheet. <a href="https://app.daily.dev/feed-by-ids?id=A9H2rpmDZ&amp;id=NhGwNaYRA&amp;id=isGrxmwaT&amp;id=wjXnstnI7" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
