<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are actively affecting JavaScript package managers like npm and yarn, allowing attackers to bypass security controls designed to prevent worm attacks. While pnpm, vlt, and Bun have already patched these flaws, npm claims the behavior is an intentional design choice, not a bug. Developers are strongly advised by researcher Oren Yomtov to migrate to patched package managers to avoid potential malicious payload delivery. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day forces emergency patch</strong>: Microsoft issued an emergency out-of-band patch for a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office, actively exploited in the wild. The flaw, a security feature bypass, allows attackers to circumvent protections against legacy COM and OLE components using malicious Office files. While newer versions are patched, Office 2016 and 2019 users must rely on manual registry workarounds, and CISA has mandated federal agencies patch by February 16, 2026. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ShinyHunters targets Okta SSO credentials at major tech firms</strong>: The cybercriminal group ShinyHunters is conducting a credential-theft campaign against approximately 100 organizations, including Canva, Atlassian, RingCentral, and ZoomInfo. The attacks leverage Okta single sign-on (SSO) accounts through voice-phishing (vishing) and advanced social engineering to trick employees into revealing MFA credentials, allowing attackers to enroll their own devices and exfiltrate sensitive data. Security researchers strongly recommend using phishing-resistant MFA like FIDO2 security keys or passkeys. <a href="https://app.daily.dev/posts/Z5ZlrJvjT" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI agents are transforming enterprise operations and developer roles</strong>: AI agents are shifting developer roles from coding to product architecture, automating execution, and integrating into enterprise systems as ‘coworkers,’ necessitating new infrastructure for orchestration and governance to prevent ‘agent sprawl’ and ensure accountability. <a href="https://app.daily.dev/feed-by-ids?id=b2fEANN64&amp;id=yBxtGCVqr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Teleport unveils agentic identity framework for AI agent security</strong>: Teleport launched a new Agentic Identity Framework that uses cryptographic authentication and zero-trust principles to secure AI agents, providing real-time visibility, least-privileged access, and prompt tracking to combat prompt injection and agent compromise. <a href="https://app.daily.dev/posts/CI1C8FH63" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare launches serverless, post-quantum Matrix homeserver</strong>: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, leveraging serverless architecture and post-quantum cryptography to offer end-to-end encrypted messaging with sub-50ms global latency and minimal operational overhead. <a href="https://app.daily.dev/posts/vURH9h7xw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS Network Firewall adds GenAI traffic controls</strong>: AWS Network Firewall now offers web category-based filtering for generative AI application traffic, allowing security teams to block or restrict access to GenAI services at the network level and enforce compliance with granular controls. <a href="https://app.daily.dev/posts/AdbvgaiZY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go team proposes generic methods</strong>: The Go team has proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability, with full backward compatibility and static compile-time resolution. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust Foundation expands funding and outlines 2026-2028 strategy</strong>: The Rust Foundation raised $5.1 million in 2025, investing $2.7 million into the Rust Project, and outlined a 2026-2028 strategy focusing on stable infrastructure, sustainable maintainer support, and responsible adoption growth. <a href="https://app.daily.dev/posts/y4jhOcrNg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KPHP: <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a>’s open-source PHP compiler for performance</strong>: <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a> has open-sourced KPHP, a PHP compiler that transpiles a restricted subset of PHP to C++ for native binaries, offering 3-10x speed improvements over standard PHP with compile-time type inference and optimizations. <a href="https://app.daily.dev/posts/801wep0xd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding agents are still mostly hype, says OpenAI (and everyone else)</strong>: OpenAI’s latest technical breakdown of its Codex CLI agent admits that while AI coding tools like Codex and Claude Code are good for boilerplate, they’re ‘brittle’ and ‘prone to errors’ outside their training data. Apparently, they still need human oversight, especially for production. So much for fully autonomous coding, eh? Meanwhile, developers are still finding AI-generated Swift code to be unnecessarily complex and full of subtle semantic errors, requiring constant human review to maintain quality. It seems the ‘AI will code everything’ dream is still firmly in the ‘dream’ category. <a href="https://app.daily.dev/feed-by-ids?id=qZX3wHxMK&amp;id=uilUGnhp4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>D-Wave’s quantum computing roadmap: all talk, no qubits (yet)</strong>: D-Wave is making big claims about 314% year-over-year usage growth and a $10 million contract with an unnamed Fortune 100 company, all while outlining an ‘accelerated’ gate-model quantum computing roadmap. They even acquired Quantum Circuits (terms undisclosed, naturally). But, as usual, it’s all based on D-Wave’s own press releases, with no third-party verification. So, lots of talk about future milestones and ‘billions of qubits,’ but actual, verifiable quantum breakthroughs? Still waiting. <a href="https://app.daily.dev/posts/B9UXF3b8Z" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI is killing public knowledge platforms, or so they say</strong>: Apparently, AI models like ChatGPT and Claude are causing a ‘model collapse’ by making developers abandon Stack Overflow and Wikipedia, leading to a 78% traffic drop for the former. The argument is that AI is eating the public commons that trained it, leading to a feedback loop of degrading AI quality. Because, you know, the internet was always a bastion of ‘rigor’ and ‘public discourse’ before AI came along. Maybe the problem isn’t AI, but the fact that we’re still relying on 20-year-old forum models for knowledge sharing. <a href="https://app.daily.dev/posts/3Qlqmk7FI" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
