<h2>Must know</h2>
<ul>
<li><strong>Node.js critical DoS vulnerability impacts major frameworks</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js, affecting versions 8.x through 24.x, can crash applications using <code>async_hooks</code> or <code>AsyncLocalStorage</code> due to unhandled stack overflows. This impacts major frameworks like Next.js and React Server Components, as well as APM tools such as Datadog, New Relic, and OpenTelemetry. Patches have been released for supported versions 20.20.0, 22.22.0, 24.13.0, and 25.3.0, and immediate upgrades are recommended, according to Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full impersonation</strong>: A critical vulnerability, dubbed BodySnatcher (CVE-2025-12420), was found in ServiceNow’s Virtual Agent AI platform. It allowed unauthenticated attackers to impersonate any user with just an email address, bypassing passwords and MFA. This flaw, rooted in weak authentication combined with new AI capabilities, could grant access to HR, customer service, and security modules, and even create rogue AI agents. ServiceNow has since patched the issue, rotated credentials, and removed the exploited AI functionality, as confirmed by AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday includes actively exploited zero-day</strong>: Microsoft’s January 2026 Patch Tuesday addresses over 112 vulnerabilities, including eight critical ones. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR and leak memory addresses. While it requires local access, CISA has added it to their Known Exploited Vulnerabilities catalog, mandating federal agencies patch by February 3, 2026. This highlights the urgency for all organizations to apply updates, as reported by Krebs on Security and The Hacker News. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cursor AI editor boosts token efficiency with dynamic context</strong>: Cursor, an AI code editor, introduced dynamic context discovery, reducing LLM token consumption by 46.9% by allowing AI agents to retrieve code context only when needed, leading to faster responses and lower operational costs. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents port Rust to Go with minimal human oversight</strong>: An experienced developer successfully ported a Rust-based Jinja2 template engine to Go using AI agents, requiring only 45 minutes of active guidance and 10 hours of autonomous work, demonstrating AI’s potential for cross-language porting. <a href="https://app.daily.dev/posts/VOMBPE1Xs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Trends and Kaggle enhance AI usability and evaluation</strong>: Google Trends now integrates Gemini AI for identifying and comparing search trends, while Kaggle launched Community Benchmarks, allowing users to create and share custom evaluation tasks for AI models. <a href="https://app.daily.dev/feed-by-ids?id=WhUrXR4tI&amp;id=XLEr4o2U6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine monitors LLM API usage and costs</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and error rates, providing a dashboard and configurable alerts for better cost management and optimization. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 adds picture-in-picture and platform optimizations</strong>: Firefox 147 introduces automatic Picture-in-Picture video playback, reorganized tab settings, enhanced WebGPU support for Apple Silicon, and zero-copy hardware video playback for AMD GPUs on PC. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bandcamp bans substantially AI-generated music</strong>: Bandcamp announced a ban on music and audio created wholly or substantially by AI, effective January 2026, aiming to protect human artists and ensure authenticity for fans, diverging from platforms like Spotify. <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel adds initial support for new GPUs</strong>: Intel’s Compute Runtime version 26.01.36711.4 introduces initial support for Crescent Island and Nova Lake S graphics hardware, continuing Level Zero and OpenCL API support for GPUs back to Tiger Lake. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated books are the new spam</strong>: Apparently, HiTeX Press has managed to churn out over 800 technical books in a single year, all entirely AI-generated and without human oversight. These masterpieces are filled with fabricated code and non-existent features, yet they’re being sold on major platforms like Amazon. So, if you’re looking for reliable technical knowledge, maybe don’t trust the 8€ book written by ‘AI’s finest pseudonyms.’ <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents are still just glorified interns</strong>: Senior developers are still scratching their heads over the hype around LLM agentic coding tools, finding them slow, needy, and not exactly a productivity booster for anyone who knows what they’re doing. While some claim these tools are great for ‘vibe coding,’ others point out that AI-generated code often lacks architectural sense and introduces more problems than it solves. So much for replacing senior engineers; looks like we’re still stuck with the humans for now. <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd&amp;id=rN9O2D75a&amp;id=yHP3jyLio&amp;id=aKs6sRZ4B&amp;id=zVkqeCNSc&amp;id=AqUqj1Sbi&amp;id=H430dwVHX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quantum security: The government’s favorite new buzzword</strong>: U.S. federal agencies are finally moving from ‘awareness’ to ‘implementation’ on quantum security, mostly because they’re terrified of ‘harvest now, decrypt later’ attacks. NIST has even finalized some post-quantum cryptography standards, which is great, but they’re also admitting this is a ‘multi-year undertaking.’ So, while they’re urging everyone to inventory their crypto assets, it sounds like we’re still a long way from actually being quantum-proof. Better start counting those bits now, folks. <a href="https://app.daily.dev/feed-by-ids?id=lRZsyJgWP&amp;id=A9H2rpmDZ&amp;id=NhGwNaYRA&amp;id=isGrxmwaT&amp;id=wjXnstnI7" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
