<h2>Must know</h2>
<ul>
<li><strong>Node.js vulnerability causes widespread DoS risk</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js affects versions 8.x through 24.x, causing process crashes if <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled. This impacts major frameworks like Next.js and React Server Components, as well as APM tools such as Datadog. Node.js has released patches for supported versions, and immediate upgrades are recommended to prevent service downtime, as reported by Node.js release notes and Datadog. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday brings critical security updates</strong>: Microsoft’s January 2026 Patch Tuesday addresses over 112 vulnerabilities, including eight critical ones. A zero-day vulnerability (CVE-2026-20805) in Desktop Window Manager, actively exploited to bypass ASLR, has been added to CISA’s Known Exploited Vulnerabilities catalog, mandating federal patching by February 3, 2026. This highlights the urgent need for organizations to apply these fixes, according to Krebs on Security and BleepingComputer. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical AI agent authentication flaw in ServiceNow</strong>: ServiceNow’s Virtual Agent AI platform had a critical vulnerability (CVE-2025-12420) that allowed unauthenticated attackers to impersonate any user with just an email address, bypassing MFA. This flaw, dubbed ‘BodySnatcher’ by AppOmni, could lead to admin account creation and privilege escalation across connected modules. ServiceNow has since issued a patch and removed the exploited AI agent functionality, emphasizing the risks of rapidly integrating AI agents without robust security controls. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Firefox 147 enhances web experience</strong>: Firefox 147 introduces automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU support for Apple Silicon, zero-copy hardware video playback for AMD GPUs on PC, and Linux support for XDG Base Directory Specification, alongside security fixes and Google Safe Browsing v5. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New CSS @function syntax has drawbacks</strong>: The new CSS @function syntax allows reusable functions but suffers from poor IDE support, naming conflicts with CSS variables, cascading issues, complex interactions with <code>@layer</code>, and weak type enforcement, making it not yet production-ready despite enabling interesting responsive logic. <a href="https://app.daily.dev/posts/uRadSBTOK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bandcamp bans substantially AI-generated music</strong>: Bandcamp has announced a ban on music and audio created wholly or substantially by AI, effective January 2026, aiming to protect human artists and ensure authenticity, a move that diverges from platforms like Spotify. <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor code editor optimizes AI token usage</strong>: Cursor, an AI code editor, introduced dynamic context discovery to reduce LLM token consumption by 46.9% by accessing code context only when needed, aiming for lower operational costs and faster AI response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks expands AI partnerships</strong>: Databricks is integrating with Atlassian Rovo for natural language queries on enterprise data and partnering with Algonomy to deliver RetailAI for agentic retail planning, aiming to democratize data access and enhance predictive capabilities. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fabric.js library for HTML5 canvas</strong>: Fabric.js is a JavaScript library providing an interactive object model for HTML5 canvas, offering features like SVG import/export, text editing, WebGL/Canvas2d filters, animations, and interactive controls for complex graphics. <a href="https://app.daily.dev/feed-by-ids?id=tiabwh937&amp;id=ZfUUG6nJX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quantum dot breakthrough for telecom</strong>: Researchers developed a single-photon source using InAs quantum dots operating in the telecom C-band, achieving 91.7% two-photon interference visibility, a record for solid-state sources in this range, potentially enabling practical quantum networks. <a href="https://app.daily.dev/posts/woujp8xYd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding tools: still not senior engineers</strong>: Apparently, some senior developers are still surprised that LLM-based coding tools are slow, require constant supervision, and don’t magically turn junior devs into architects. While useful for documentation or enabling non-developers, AI-generated Kotlin code, for example, is functionally correct but architecturally unsound, mishandling coroutines and lifecycle management. So, if you thought AI was going to replace your senior staff, you might want to re-evaluate your expectations, as noted by various senior developer critiques. <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated technical books: the new spam</strong>: HiTeX Press has managed to churn out over 800 AI-generated technical books in a single year, complete with fabricated code and non-existent features, all under pseudonymous authors. These masterpieces are being sold on major platforms like Amazon, making it harder for actual learners to find reliable information. It seems the ‘AI revolution’ is just another way to flood the market with low-quality content, as highlighted by an investigation into this ‘spam factory’. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quantum security: the federal government is ‘advancing’</strong>: U.S. federal agencies are finally moving from ‘awareness’ to ‘implementation’ on quantum security, primarily to combat the ‘harvest now, decrypt later’ threat. NIST has even finalized some post-quantum cryptography standards, which is great, but they’re also admitting this is a ‘multi-year undertaking.’ So, while they’re urging everyone to inventory their crypto assets <em>immediately</em>, don’t expect any miracles soon. It’s almost like they just discovered quantum computing isn’t a distant sci-fi concept, as reported by various federal agency representatives. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
