<h2>Must know</h2>
<ul>
<li><strong>AI coding agents are still a security nightmare</strong>: A new study by Tenzai reveals that AI coding agents like Claude Code, OpenAI Codex, Cursor, Replit, and Devin consistently introduce critical vulnerabilities, especially in business logic and API authorization. While they handle common flaws like SQL injection, they fail at context-dependent security, leading to issues like authentication bypasses and negative pricing. This echoes the recent ServiceNow vulnerability (CVE-2025-12420) where AI agents enabled unauthenticated user impersonation, bypassing MFA and SSO. It seems the rush to deploy AI is creating more security holes than it solves, as reported by The Hacker News and AppOmni. <a href="https://app.daily.dev/feed-by-ids?id=VwQJWH3Oi&amp;id=wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft open-sources XAML Studio and patches critical vulnerabilities</strong>: Microsoft has open-sourced XAML Studio under the .NET Foundation, aiming to foster community collaboration for rapid UI prototyping. This move comes as Microsoft also released its January 2026 Patch Tuesday updates, addressing 112-114 vulnerabilities, including a zero-day (CVE-2026-20805) in Desktop Window Manager already being exploited. Additionally, Microsoft disrupted the RedVDS cybercrime platform, which facilitated phishing and fraud using pirated Windows Server installations. So, while they’re giving away UI tools, they’re also busy patching critical flaws and fighting cybercrime, as detailed by Krebs on Security and The Hacker News. <a href="https://app.daily.dev/feed-by-ids?id=hUJrXK08w&amp;id=Kwy6WAbQP&amp;id=B3gSK2e83" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Mandiant forces NTLMv1 deprecation with public rainbow tables</strong>: Google-owned Mandiant has released comprehensive rainbow tables for Net-NTLMv1, making it trivial to crack credentials in under 12 hours with consumer-grade hardware. Their goal is to force organizations to finally abandon this 20-year-old insecure protocol, which is still prevalent in legacy systems. This controversial move effectively weaponizes the vulnerability to accelerate its deprecation, highlighting the urgent need for organizations to disable NTLMv1 immediately, as widely reported across security news outlets. <a href="https://app.daily.dev/posts/2q2phjvWS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Next.js 16 stabilizes Turbopack and adds AI debugging</strong>: Next.js 16 makes Turbopack the default bundler for faster builds and hot reloading, introduces explicit Cache Components, and integrates AI-assisted debugging via Model Context Protocol (MCP) in DevTools. <a href="https://app.daily.dev/posts/91xiEmcVe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bun v1.3.6 boosts performance and adds new APIs</strong>: Bun v1.3.6 introduces APIs for tarball creation/extraction and JSONC parsing, significantly speeds up Response.json() and async/await, and includes 45 bug fixes for Node.js compatibility and security. <a href="https://app.daily.dev/posts/Wx4br4Zyw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS CodeBuild regex misconfiguration exposed supply chain risk</strong>: Wiz researchers found a critical flaw in AWS CodeBuild due to improperly anchored regex patterns, allowing attackers to bypass security controls and potentially gain admin access to repositories like the AWS JavaScript SDK, though AWS patched it quickly. <a href="https://app.daily.dev/posts/q7gLeN4EH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js releases address multiple CVEs</strong>: Node.js versions 20.20.0 LTS and 25.3.0 were released, patching several security vulnerabilities including a critical DoS flaw (CVE-2025-59466) affecting async_hooks and AsyncLocalStorage when enabled. <a href="https://app.daily.dev/feed-by-ids?id=DwsoMgMKH&amp;id=EyLXGRUe2&amp;id=WX4br4Zyw&amp;id=Yy5NFIIOM&amp;id=Zr0Dv9dwZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ClickHouse raises $400M and acquires Langfuse</strong>: ClickHouse secured $400 million in Series D funding, valuing it at $15 billion, and acquired Langfuse, an open-source LLM observability platform, to create a unified AI analytics and debugging platform. <a href="https://app.daily.dev/posts/9QbO7XqRY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub Copilot introduces repository-specific agentic memory</strong>: GitHub Copilot now features an opt-in ‘memories’ system in Visual Studio that learns and documents coding preferences and project guidelines, aiming to improve code consistency and accelerate onboarding. <a href="https://app.daily.dev/posts/nCmOnsQS3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS European Sovereign Cloud now available</strong>: AWS has launched its European Sovereign Cloud, with infrastructure entirely within the EU and operated by EU residents, offering comprehensive AWS services with enhanced data residency controls. <a href="https://app.daily.dev/posts/DTVSjPW7g" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding assistants: the data is brutal, but we keep pushing them</strong>: Turns out, those shiny AI coding assistants are making developers slower, doubling bugs, and increasing code churn. Despite generating 46% more code, developers are 19% less productive and AI-generated code has 1.7x more bugs. But hey, who needs architectural understanding or human judgment when you can just merge more garbage faster? As The Serious CTO points out, it’s all about typing speed, not actual engineering. <a href="https://app.daily.dev/feed-by-ids?id=5khP9Wt37&amp;id=J24eplQdr&amp;id=DdiXGTqPN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI is eating developer skills, but don’t worry, just ‘learn to prompt’</strong>: AI coding assistants are apparently eroding fundamental developer skills like reading documentation and critical thinking. Why bother learning when an LLM can give you an instant, possibly hallucinated, answer? Tailwind CSS even laid off 75% of its engineers because developers stopped visiting their site. The new ‘skill’ is prompt engineering, because apparently, guiding a glorified autocomplete is the pinnacle of modern software development, as Awesome-Coding and Stefan Mischook so subtly imply. <a href="https://app.daily.dev/feed-by-ids?id=bNykMIpel&amp;id=6PqxqIHlh" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Vertex AI privilege escalation: ‘working as intended’</strong>: Security researchers found privilege escalation vulnerabilities in Google Vertex AI, allowing low-privileged users to hijack high-privileged Service Agent roles. Google’s response? ‘Working as intended.’ Because nothing says ‘secure cloud infrastructure’ like default configurations that let attackers gain project-wide privileges. It’s almost as if convenience trumps security until a major breach forces a ‘re-evaluation’ of what ‘intended’ really means, as reported by The Hacker News. <a href="https://app.daily.dev/posts/Hkx4xvScf" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
