<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are actively affecting JavaScript package managers like npm and yarn, allowing attackers to bypass security controls designed to prevent worm attacks. While pnpm, vlt, and Bun have already patched these flaws, npm and yarn have yet to do so, with npm claiming the behavior is ‘by design.’ Security researcher Oren Yomtov strongly advises developers to migrate to patched package managers to avoid potential malicious payload delivery. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day forces emergency patch</strong>: Microsoft released an emergency out-of-band patch for a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office, actively exploited in the wild. This flaw, rated 7.8 CVSS, allows attackers to bypass security protections using malicious Office files. While newer Office versions and Microsoft 365 Apps are patched, Office 2016 and 2019 users must rely on manual registry workarounds, with CISA mandating federal agencies patch by February 16, 2026. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ShinyHunters targets Okta SSO credentials at major tech firms</strong>: The cybercrime group ShinyHunters is conducting a credential-theft campaign against approximately 100 organizations, including Canva, Atlassian, RingCentral, and ZoomInfo. The attacks leverage voice-phishing (vishing) to trick employees into revealing Okta single sign-on (SSO) and MFA credentials, allowing attackers to enroll their own devices for persistent access and data exfiltration. Security researchers strongly recommend using phishing-resistant MFA like FIDO2 security keys or passkeys, as reported by The Register. <a href="https://app.daily.dev/feed-by-ids?id=Z5ZlrJvjT&amp;id=PgaIv4Isr" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Rust at scale: WhatsApp replaces C++ for media security</strong>: WhatsApp replaced 160,000 lines of C++ with 90,000 lines of Rust to build Kaleidoscope, a media consistency library that protects billions of users from malware by validating media files against format standards and detecting malicious patterns before they can exploit OS vulnerabilities, demonstrating Rust’s production-readiness at massive scale across diverse platforms. <a href="https://app.daily.dev/posts/2YIPmtHiF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go team proposes generic methods</strong>: The Go team has proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability, while maintaining backward compatibility and static compile-time resolution. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare launches serverless post-quantum Matrix homeserver</strong>: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, leveraging a serverless architecture with D1, KV, R2, and Durable Objects, and implementing X25519MLKEM768 post-quantum cryptography by default to protect against harvest-now-decrypt-later attacks. <a href="https://app.daily.dev/posts/vURH9h7xw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Picolibc 1.8.11 released with RISC-V and Hexagon updates</strong>: Picolibc version 1.8.11 has been released, bringing improvements for the RISC-V architecture, support for Qualcomm Hexagon processors, and enhanced POSIX compliance, broadening compatibility and standards alignment for embedded C development. <a href="https://app.daily.dev/posts/XNeTbsf3f" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CISA publishes federal guidance on post-quantum cryptography adoption</strong>: CISA has released guidance mapping NIST-standardized post-quantum cryptography (PQC) algorithms to enterprise hardware and software, advising federal agencies to procure only PQC-capable products where solutions are available, highlighting adoption gaps in digital signatures and authentication. <a href="https://app.daily.dev/posts/5Lj7cpvbX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS Network Firewall adds GenAI traffic controls</strong>: AWS Network Firewall now supports web category-based filtering for generative AI application traffic, allowing security teams to block or restrict access to GenAI services at the network level and enforce compliance, especially when combined with TLS inspection. <a href="https://app.daily.dev/posts/AdbvgaiZY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Mozilla announces 2025-26 strategic direction for open-source AI</strong>: Mozilla has unveiled its 2025-26 strategic direction, aiming to shape AI development with a focus on human-centric, privacy-first, open-source technology, expanding into new AI ventures while sustaining investment in Firefox and Thunderbird, and fostering a community of open-source developers. <a href="https://app.daily.dev/posts/z6ruEckcB" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Cloudflare’s Matrix homeserver: a masterclass in how not to release software</strong>: Cloudflare, in its infinite wisdom, decided to announce a ‘complete’ Matrix homeserver on its Workers platform. A Matrix developer, however, quickly pointed out that this ‘complete’ solution conveniently forgot critical security features like authorization and state resolution, is riddled with TODOs, and would cost more than a standard VPS. Apparently, ‘serverless’ now means ‘less secure, less functional, and more expensive,’ as detailed in the scathing critique. <a href="https://app.daily.dev/posts/93HDTbjA4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents: still more hype than help</strong>: OpenAI’s latest technical breakdown of its Codex CLI coding agent admits that while AI is great for boilerplate, it’s ‘brittle and prone to errors’ outside its training data, still requiring human oversight for production. Meanwhile, other ‘experts’ are still trying to convince us that AI agents are ‘quietly transforming the enterprise’ and that developers should become ‘outcome engineers.’ Maybe we should just focus on making the tools actually work reliably before we start redefining entire job roles, as highlighted by the ongoing need for human intervention and the critique of current coding agent tooling by Justin Searls. <a href="https://app.daily.dev/feed-by-ids?id=qZX3wHxMK&amp;id=b2fEANN64&amp;id=yBxtGCVqr&amp;id=mM6RmfXs7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated code: the fast track to technical debt</strong>: Turns out, those shiny new AI coding agents, even the ‘improved’ ones like Sonnet 4.5, are still churning out code that violates language idioms, adds unnecessary complexity, and introduces subtle semantic errors. So, while they might make you feel productive, you’ll still need a human expert to clean up the mess and prevent your codebase from becoming an unmaintainable nightmare. It’s almost like good software requires actual thought, not just rapid-fire token generation. <a href="https://app.daily.dev/feed-by-ids?id=uilUGnhp4&amp;id=dABjwqV7N" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
