<h2>Must know</h2>
<ul>
<li><strong>Critical Node.js DoS vulnerability impacts major frameworks</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js, affecting versions 8.x through 24.x, causes process crashes when <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled. This impacts major frameworks like Next.js and React Server Components, as well as APM tools such as Datadog and OpenTelemetry. Node.js has released patches for supported versions, and immediate upgrades are recommended to prevent service downtime, as reported by Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full impersonation</strong>: ServiceNow’s Virtual Agent AI platform had a critical vulnerability (CVE-2025-12420, ‘BodySnatcher’) that allowed unauthenticated attackers to impersonate any user with just an email address, bypassing passwords and MFA. This flaw, rooted in weak authentication combined with new AI capabilities, could grant access to connected modules and escalate privileges. While no active exploitation was found, ServiceNow promptly issued a patch and removed the exploited AI agent functionality, as confirmed by AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday includes actively exploited zero-day</strong>: Microsoft’s January 2026 Patch Tuesday addressed over 112 vulnerabilities, including a critical zero-day (CVE-2026-20805) in Desktop Window Manager. This flaw, actively exploited in the wild, leaks memory addresses to bypass ASLR, increasing risk when chained with other exploits. CISA has added it to their Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026, according to Krebs on Security and The Hacker News. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI coding tools shift focus from writing to defining requirements</strong>: AI-powered coding agents are making code implementation faster, shifting the development bottleneck from writing code to defining clear requirements and deciding what to build, demanding stronger product management to prevent feature bloat. <a href="https://app.daily.dev/posts/H430dwVHX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI editor optimizes token usage with dynamic context discovery</strong>: Cursor, an AI code editor, introduced dynamic context discovery, reducing LLM token consumption by 46.9% by allowing AI agents to retrieve code context on-demand, lowering costs and improving response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks partners for AI-driven data insights and retail planning</strong>: Databricks is expanding its AI capabilities through partnerships with Atlassian Rovo for natural language queries on enterprise data and Algonomy for AI-driven retail planning solutions, aiming to democratize data access and optimize retail operations. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>U.S. federal agencies prepare for quantum security migration</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to implementation of quantum security practices, focusing on migrating to post-quantum cryptography to counter ‘harvest now, decrypt later’ threats. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bandcamp bans substantially AI-generated music</strong>: Bandcamp announced a ban on music and audio created wholly or substantially by AI, effective January 2026, aiming to protect human artists and ensure authenticity, a move that diverges from streaming platforms like Spotify. <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Trends and Kaggle enhance AI usability and evaluation</strong>: Google Trends now integrates Gemini AI to identify and compare related search trends, while Kaggle released Community Benchmarks, allowing users to create and share custom evaluation tasks for AI models, both aiming to improve AI usability and assessment. <a href="https://app.daily.dev/feed-by-ids?id=WhUrXR4tI&amp;id=XLEr4o2U6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine launched for LLM API monitoring</strong>: RubyLLM::Monitoring, a new Rails engine, tracks LLM API usage, cost, and performance within Rails applications, providing dashboards and configurable alerts for cost ceilings, error spikes, and performance degradation. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: still not senior engineers, apparently</strong>: Turns out, Claude Opus 4.5, while great at debugging Sentry or migrating AWS ECS, still can’t replace a senior engineer’s judgment or abstraction skills. The author of ‘Claude is not a senior engineer (yet)’ points out that these ‘autonomous’ systems amplify well-designed infrastructure but aren’t building it from scratch. So, if you were hoping to fire your entire dev team, you might want to hold off; they still need someone to tell the AI what to do, and then check its work. <a href="https://app.daily.dev/feed-by-ids?id=GMZHoSF60&amp;id=Jj0H2b0XQ&amp;id=SMEJx6ENk&amp;id=Z1R08OC6I&amp;id=ZBZXWSG4p&amp;id=ZsPWeN0Lt&amp;id=dl9u8nkjK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>LLM maximalists still pushing ‘vibe coding’ despite senior dev skepticism</strong>: Some senior developers are still scratching their heads over the hype around LLM agentic coding tools, finding them slow and requiring more supervision than they’re worth. Articles like ‘The Insecure Evangelism of LLM Maximalists’ suggest that those pushing ‘vibe coding’ might be projecting their own insecurities, dismissing expert skepticism as mere resistance to change. Meanwhile, AI-generated Android Kotlin code is functionally correct but architecturally a mess, proving that ‘working’ code doesn’t always mean ‘good’ code. <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated technical books: the new spam</strong>: HiTeX Press has apparently mastered the art of industrial-scale technical book spam, releasing over 800 AI-generated titles in a single year. These masterpieces, penned by two pseudonymous authors, feature fabricated code and non-existent programming features, making them utterly useless for anyone actually trying to learn something. They’re even on Amazon, so good luck distinguishing actual knowledge from algorithmic garbage. It’s almost like quality control is an afterthought when you’re churning out books by the hundreds. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
