<h2>Must know</h2>
<ul>
<li><strong>Critical AI agent vulnerability in ServiceNow exposed</strong>: A critical vulnerability, dubbed ‘BodySnatcher,’ was found in ServiceNow’s Virtual Agent AI platform, allowing unauthenticated attackers to impersonate any user with just an email address, bypassing MFA. This flaw, confirmed by AppOmni and ServiceNow, enabled privilege escalation across connected modules and the creation of rogue AI agents. While no active exploitation was found, it highlights the systemic risks of integrating AI agents with expansive access, as noted by both AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js DoS vulnerability impacts major frameworks</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js affects versions 8.x through 24.x, causing process crashes when <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled. This impacts major frameworks like Next.js and React Server Components, as well as APM tools like Datadog. Node.js has released patches for supported versions, re-throwing stack overflow errors to prevent fatal exits, as confirmed by Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>US federal agencies ramp up quantum security efforts</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to implementation of quantum security practices, focusing on migrating to post-quantum cryptography (PQC) to counter ‘harvest now, decrypt later’ threats. NIST has finalized initial PQC standards, and agencies are urged to inventory cryptographic assets and adopt hybrid solutions. This multi-year undertaking emphasizes the urgent need to protect both legacy systems and emerging quantum research, as detailed in official statements. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Bandcamp bans substantially AI-generated music</strong>: Bandcamp has implemented a policy banning music and audio created wholly or substantially by AI, aiming to protect human artists and ensure authenticity for fans, a move that diverges from platforms like Spotify. <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI editor optimizes token usage with dynamic context</strong>: Cursor, an AI code editor, introduced dynamic context discovery, reducing LLM token consumption by 46.9% by allowing AI agents to access code context only when needed, which lowers costs and improves response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated book spam floods technical publishing</strong>: HiTeX Press has released over 800 AI-generated technical books in one year, containing fabricated code and meaningless content, polluting major platforms like Amazon and making it difficult for learners to find reliable resources. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks expands AI partnerships for data insights</strong>: Databricks is partnering with Atlassian Rovo for natural language queries on enterprise data and with Algonomy for AI-driven retail planning solutions, aiming to democratize data access and move businesses towards predictive operations. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New Rails engine monitors LLM API usage and costs</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and error rates within applications, providing a dashboard and configurable alerts for cost optimization and performance management. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Thunderbird 147 released with new features</strong>: Firefox 147 introduces automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU support for Mac, and zero-copy hardware video playback for AMD GPUs on PC, while Thunderbird 147 adds folder path options and optional localization. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quantum dot breakthrough for telecom C-band</strong>: Researchers developed a single-photon source using InAs quantum dots operating in the telecom C-band, achieving 91.7% two-photon interference visibility, a significant step towards practical quantum networks compatible with existing fiber optics. <a href="https://app.daily.dev/posts/woujp8xYd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding tools: still not replacing senior engineers, apparently</strong>: Senior developers are still out here complaining that LLM coding tools are slow, require too much supervision, and don’t actually boost productivity for experienced programmers. Meanwhile, some ‘LLM maximalists’ are apparently projecting their insecurities by dismissing skepticism as resistance to change. It seems the dream of AI replacing all the ‘boring’ coding tasks is still just that—a dream, especially when AI-generated Android code is functionally correct but architecturally a mess, as noted by various senior devs. <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents: the new insider threat, now with physical vulnerabilities</strong>: Just when you thought prompt injection was the only thing to worry about, apparently AI agents with elevated privileges are now insider threats, and even humanoid robots can be remotely compromised via voice commands to propagate attacks. So, not only do we have to worry about our data, but now our robot overlords might turn on us because someone whispered the wrong thing. Good to know our future dystopia is well-rounded, as research from various sources suggests. <a href="https://app.daily.dev/feed-by-ids?id=MpJOJGOmA&amp;id=bwVFAnzEc&amp;id=c8Xk5dH7c" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The ‘human-centered’ data analytics that forgot the humans</strong>: Apparently, many data analytics initiatives fail because they forget the ‘human context’ behind the numbers, leading to ‘trashboards’ no one uses. Who knew that building solutions for people might involve, you know, <em>considering</em> the people? This ‘human-centered’ approach, as described by Towards Data Science, sounds suspiciously like good old-fashioned user experience design, but with more buzzwords. Revolutionary! <a href="https://app.daily.dev/posts/51nBU77dY" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
