<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are affecting JavaScript package managers like npm and yarn, allowing attackers to bypass security controls designed to prevent worm attacks. While pnpm, vlt, and Bun have released patches, npm and yarn have not, with npm claiming the behavior is ‘by design.’ Researcher Oren Yomtov strongly advises developers to migrate to patched package managers to avoid potential malicious payload delivery. This is a critical security alert for anyone in the JavaScript ecosystem. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day forces emergency patch</strong>: Microsoft issued an emergency out-of-band patch for a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office, actively exploited in the wild. The flaw, a security feature bypass, allows attackers to circumvent protections against legacy COM and OLE components using malicious Office files. While newer versions are patched, Office 2016 and 2019 users must rely on manual registry workarounds. CISA has mandated federal agencies patch this by February 16, 2026, highlighting the urgency. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI use accelerates decline of public knowledge platforms</strong>: AI models like ChatGPT and Claude are increasingly replacing public knowledge platforms such as Stack Overflow and Wikipedia for problem-solving, leading to a reported 78% drop in Stack Overflow traffic. This shift risks a ‘model collapse’ where future AIs, trained on increasingly AI-generated content, degrade in quality due to detachment from human expertise. The concern is that this fragments open collaboration and collective learning, favoring private, immediate solutions over communal knowledge. <a href="https://app.daily.dev/posts/3Qlqmk7FI" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cloudflare launches serverless post-quantum Matrix homeserver</strong>: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, leveraging a serverless architecture and X25519MLKEM768 post-quantum cryptography to protect against harvest-now-decrypt-later attacks, offering end-to-end encrypted messaging with sub-50ms global latency for less than $1/month. <a href="https://app.daily.dev/posts/vURH9h7xw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Teleport unveils agentic identity framework for AI agent access</strong>: Teleport launched a new Agentic Identity Framework that uses cryptographic authentication for AI agents, moving beyond static credentials to provide zero-trust access, hardware-based root of trust, and real-time monitoring to secure AI agent interactions with infrastructure and combat prompt injection attacks. <a href="https://app.daily.dev/posts/CI1C8FH63" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go language team proposes generic methods</strong>: The Go team has proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability, while maintaining backward compatibility and static compile-time resolution. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Alibaba Cloud releases open-source voice cloning model</strong>: Alibaba Cloud released Quen 3 TTS, an open-source text-to-speech and voice cloning model that can generate realistic voices from short audio samples on consumer hardware, significantly lowering the barrier to entry for voice cloning and potentially disrupting commercial offerings like ElevenLabs. <a href="https://app.daily.dev/posts/n9i7dpE8S" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ai2 releases open-source SERA coding agent models</strong>: The Allen Institute for AI (Ai2) released SERA, an open-source family of coding agent models designed for customization and fine-tuning on private codebases at significantly reduced costs (estimated $400-$2,000), with the largest model, SERA-32B, solving 55% of SWE-Bench Verified problems. <a href="https://app.daily.dev/posts/J0iLEN79d" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KPHP: open-source PHP compiler by <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a></strong>: <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a> has open-sourced KPHP, a PHP compiler that transpiles a restricted subset of PHP to C++ for native binaries, offering 3-10x speed improvements over standard PHP with compile-time type inference and optimizations, though it lacks support for dynamic features. <a href="https://app.daily.dev/posts/801wep0xd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust Foundation expands funding and outlines 2026-2028 strategy</strong>: The Rust Foundation raised $5.1 million in 2025, investing $2.7 million into the Rust Project, and outlined a 2026-2028 strategy focusing on stable infrastructure, sustainable maintainer support, responsible adoption growth, organizational engagement, and global communities to scale the ecosystem with language adoption. <a href="https://app.daily.dev/posts/y4jhOcrNg" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Cursor AI agents build a browser ‘from scratch’ (spoiler: they didn’t)</strong>: Cursor’s CEO proudly announced their AI agents built a fully functional web browser ‘from scratch’ in a week, generating over 3 million lines of code. Independent developers, however, quickly found the browser barely compiles, doesn’t work, and heavily relies on existing projects like Servo and QuickJS. So, ‘from scratch’ apparently means ‘cobbled together from other people’s work and still broken.’ Impressive marketing, less impressive reality. <a href="https://app.daily.dev/posts/gcgtwbk5H" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare’s Matrix homeserver: a masterclass in how not to release software</strong>: Cloudflare announced a Matrix homeserver implementation on its Workers platform, which a Matrix developer promptly shredded for lacking basic security features like authorization, being riddled with TODOs, and making false technical claims. Apparently, it’s so bad it might have been ‘partially AI-generated’ and would cost more than a standard VPS. So much for ‘uncompromised security and functionality’—looks like someone forgot to actually build a working product before the press release. <a href="https://app.daily.dev/posts/93HDTbjA4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ricursive Intelligence: $4B valuation for… what exactly?</strong>: Ricursive Intelligence, founded by ex-Google researchers, just snagged $300 million at a $4 billion valuation, two months after launch. Their grand plan? An AI system to design and improve AI chips. No products, no public statements from founders, and zero independent verification of their ‘AlphaChip’ claims. Sounds like another classic case of venture capitalists throwing money at a PowerPoint presentation and a few buzzwords, hoping something sticks. Good luck with that ‘self-improving intelligent chip substrate’ when the market finally asks for a demo. <a href="https://app.daily.dev/posts/pqGutcjN8" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
