<h2>Must know</h2>
<ul>
<li><strong>AI coding tools are still a security nightmare</strong>: A new study by Tenzai, a cybersecurity research firm, found 69 vulnerabilities, many critical, across 15 applications built using AI coding agents like Claude Code, OpenAI Codex, Cursor, Replit, and Devin. While these tools handle common issues like SQL injection, they consistently fail at context-dependent security logic, leading to authentication bypasses and negative pricing. This highlights that AI coding agents lack the business context of human developers, making human review essential, as reported by InfoQ. Separately, ServiceNow patched a critical AI authentication flaw (CVE-2025-12420) that allowed unauthenticated attackers to impersonate any user with just an email address, bypassing MFA and SSO, due to integrating new AI features with legacy authentication systems. <a href="https://app.daily.dev/feed-by-ids?id=VwQJWH3Oi&amp;id=wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Gemini exposed private calendar data via prompt injection</strong>: Google Gemini had a security vulnerability that allowed attackers to extract private calendar data by embedding malicious natural language prompts in Google Calendar invitations. When users asked Gemini about their schedules, the AI processed the malicious invite data, bypassing privacy controls. This indirect prompt injection flaw, discovered by security researchers, highlights emerging security risks unique to LLM-powered applications, especially in enterprise environments where LLMs connect to sensitive systems. Google has since patched the vulnerability, as detailed by The Hacker News. <a href="https://app.daily.dev/feed-by-ids?id=dHjNBMkFO&amp;id=j6bBmLvCW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Mandiant forces NTLMv1 deprecation with public rainbow tables</strong>: Google-owned cybersecurity firm Mandiant has published comprehensive rainbow tables for Net-NTLMv1, enabling credential recovery in under 12 hours with consumer-grade hardware. Their goal is to force organizations to abandon NTLMv1, a protocol known to be insecure for over 20 years but still prevalent in legacy systems. This controversial move effectively demonstrates the protocol’s insecurity by making attacks easier for both defenders and malicious actors, as reported by Krebs on Security. Microsoft recently removed NTLMv1 support from Windows Server 2025 and Windows 11, but many organizations remain exposed. <a href="https://app.daily.dev/posts/2q2phjvWS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cloudflare acquires Astro web framework</strong>: Cloudflare has acquired The Astro Technology Company, maker of the Astro web framework, which will remain open source, MIT-licensed, and platform-agnostic, with the entire Astro team joining Cloudflare to continue development. <a href="https://app.daily.dev/feed-by-ids?id=a23rECuU6&amp;id=6Yvvs8a9F&amp;id=yRAOJZmiR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js releases security updates for multiple CVEs</strong>: Node.js released versions 20.20.0 LTS and 25.3.0, addressing several CVEs including disabling futimes with the permission model, routing TLS callback exceptions, and handling stack overflow exceptions in async_hooks. <a href="https://app.daily.dev/feed-by-ids?id=DwsoMgMKH&amp;id=Yy5NFIIOM&amp;id=WX4br4Zyw&amp;id=EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New CSS features for better layouts and styling</strong>: Chrome 145 beta introduces CSS enhancements like <code>text-justify</code>, column wrapping, percentage values for <code>letter-spacing</code> and <code>word-spacing</code>, and a scrollbar-aware <code>100vw</code> unit that automatically subtracts scrollbar width. <a href="https://app.daily.dev/feed-by-ids?id=oWgZOWIXh&amp;id=52iSI4CNV&amp;id=70BWhZ4sb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub Copilot gets repository-specific memory</strong>: GitHub Copilot introduced a ‘memories’ feature in Visual Studio, allowing it to automatically learn and document coding preferences and project guidelines, organized as personal user files or version-controlled repository instructions. <a href="https://app.daily.dev/posts/nCmOnsQS3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Python 3.15.0 alpha releases with JIT upgrades</strong>: Python 3.15.0 alpha 4 and 5 were released, featuring PEP 799 (a new statistical sampling profiler), PEP 686 (UTF-8 as default encoding), PEP 782 (new PyBytesWriter C API), and JIT compiler upgrades improving performance by 3-8%. <a href="https://app.daily.dev/feed-by-ids?id=LYvLDH678&amp;id=hWOQas1o5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bun v1.3.6 brings new APIs and performance boosts</strong>: Bun v1.3.6 introduces APIs for tarball creation/extraction and JSONC parsing, adds metafile and virtual files support to Bun.build, and delivers significant performance improvements, including 3.5x faster <code>Response.json()</code> and 15% faster <code>async/await</code>. <a href="https://app.daily.dev/posts/Wx4br4Zyw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WebAssembly continues to advance with new features and tools</strong>: WebAssembly saw significant progress in 2025 with Safari closing key feature gaps, new proposals reaching standardization, Kotlin releasing a beta Wasm compiler, and .NET 10 shipping with performance improvements, with WASI 0.3 expected in February 2026. <a href="https://app.daily.dev/posts/jtf8mrjCJ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding tools: the new productivity paradox</strong>: Apparently, AI coding tools are creating 5-30 second ‘dead zones’ that fragment developer focus, leading to context switching and destroying deep work. The proposed solution? An ‘AI Detox’ protocol where you physically remove your hands from the keyboard and stare blankly at the screen while the AI thinks. Because, you know, the problem isn’t the tools, it’s your inability to meditate on command. It’s almost like they’re trying to sell us a solution to a problem they created. <a href="https://app.daily.dev/posts/j0xF0WiVr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated code: faster, but also 75% more logic errors!</strong>: Industry metrics claim 30% of senior developers are shipping mostly AI-written code, and AI now contributes to 42% of all code. But wait, code audit summaries also report AI-generated code contains 75% more logic errors and 45% more security flaws than human-written code. So, we’re just trading one problem for another, but faster! It’s like getting a self-driving car that’s 75% more likely to take a wrong turn, but hey, at least you didn’t have to steer. <a href="https://app.daily.dev/posts/J24eplQdr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The ‘AI Detox’ protocol: because your brain is the real bottleneck</strong>: A solo developer is using four AI code reviewers on every pull request, generating over 60 comments per PR, many of which are repetitive or incorrect. But hey, at least some real bugs are detected! The takeaway? ‘Annoying, imperfect AI review is better than no review.’ It’s a ringing endorsement for the future of software development: embrace the noise, sift through the garbage, and maybe, just maybe, you’ll find a gem. Who needs human collaboration when you have four AIs yelling at you? <a href="https://app.daily.dev/posts/AM0JrslAM" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
