<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are affecting JavaScript package managers like npm and yarn, allowing attackers to bypass security controls and deliver malicious payloads. While pnpm, vlt, and Bun have released patches, npm claims the behavior is by design, not a flaw. Researcher Oren Yomtov strongly advises developers to migrate to patched package managers, as reported by multiple sources. This is a critical supply chain risk for JavaScript projects. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day forces emergency patch</strong>: Microsoft released an emergency out-of-band patch for CVE-2026-21509, a critical zero-day in Microsoft Office actively exploited in the wild. The flaw, a security feature bypass, allows attackers to use malicious Office files to circumvent protections against legacy COM and OLE components. While newer Office versions are patched, Office 2016 and 2019 users must rely on manual registry workarounds, and CISA has mandated federal agencies patch by February 16, 2026, as reported by Microsoft and CISA. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ShinyHunters target Okta SSO credentials at major tech firms</strong>: The cybercriminal group ShinyHunters launched a credential-theft campaign targeting around 100 organizations, including Canva, Atlassian, RingCentral, and ZoomInfo. The attacks leverage Okta single sign-on (SSO) accounts through voice-phishing (vishing) and advanced social engineering to enroll attacker-controlled devices in victims’ MFA solutions, leading to sensitive data exfiltration. Security researchers strongly recommend phishing-resistant MFA like FIDO2 security keys or passkeys. <a href="https://app.daily.dev/posts/Z5ZlrJvjT" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI agents reshape developer roles and enterprise operations</strong>: AI agents are shifting developer roles from coding to product architecture and outcome engineering, creating new infrastructure needs for orchestration and fault tolerance, with enterprises embedding agents as integrated system features. <a href="https://app.daily.dev/feed-by-ids?id=b2fEANN64&amp;id=yBxtGCVqr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Teleport unveils agentic identity framework to secure AI agent access</strong>: Teleport launched a new Agentic Identity Framework that applies cryptographic authentication to AI agents, providing a unified identity layer, hardware-based root of trust, and zero-trust authentication to reduce credential theft and lateral movement risks. <a href="https://app.daily.dev/posts/CI1C8FH63" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare launches serverless, post-quantum Matrix homeserver</strong>: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, using a serverless architecture with D1, KV, R2, and Durable Objects, and featuring X25519MLKEM768 post-quantum cryptography by default to protect against harvest-now-decrypt-later attacks. <a href="https://app.daily.dev/posts/vURH9h7xw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CISA publishes federal guidance on post-quantum cryptography adoption</strong>: CISA released guidance mapping NIST-standardized post-quantum cryptography (PQC) algorithms to enterprise hardware and software, advising federal agencies to procure only PQC-capable products where solutions are widely available, particularly for key establishment and digital signatures. <a href="https://app.daily.dev/posts/5Lj7cpvbX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Enterprises move AI inference to private clouds</strong>: Enterprises are shifting AI inference workloads from public to private clouds due to escalating costs, reliability concerns, and the need for proximity to core business processes, aiming for predictable compute capacity and improved cost management for GPU-intensive AI. <a href="https://app.daily.dev/posts/y3MccvMQQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go language team proposes addition of generic methods</strong>: The Go team proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability, while maintaining backward compatibility and static compile-time resolution. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust Foundation expands 2025 funding, outlines 2026-2028 strategy</strong>: The Rust Foundation raised $5.1 million in 2025, investing $2.7 million into project support, and outlined a 2026-2028 strategy focusing on stable infrastructure, sustainable maintainer support, responsible adoption growth, organizational engagement, and global communities. <a href="https://app.daily.dev/posts/y4jhOcrNg" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated code and the decline of software craftsmanship</strong>: Apparently, AI-generated code is leading to a ‘decline of software craftsmanship,’ churning out mediocre software in environments that prioritize metrics over actual quality. The solution? A ‘revival of computing craft’ and a return to ‘experimental and human-centric computing paradigms.’ Because, you know, the problem isn’t that we’re asking machines to do creative work, it’s that we’ve lost our artisanal touch. Who needs efficiency when you can have ‘craft’? <a href="https://app.daily.dev/posts/dABjwqV7N" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI use accelerates decline of public knowledge platforms</strong>: ChatGPT and Claude are apparently so good that developers are abandoning Stack Overflow and Wikipedia, leading to a ‘model collapse’ where future AIs will train on increasingly AI-generated, unverified content. So, the very tools that learned from our collective knowledge are now destroying the wellspring, creating a feedback loop of misinformation. Who could have predicted that replacing human expertise with a black box might have consequences? <a href="https://app.daily.dev/posts/3Qlqmk7FI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor AI agents’ web browser claims disputed by developers</strong>: Cursor claimed its AI agents built a functional web browser with a custom Rust rendering engine and over 3 million lines of code. Developers, however, called the code ‘spaghetti,’ noted it fails to compile, and suffers from poor performance, alleging heavy reliance on external dependencies. So, it seems ‘hundreds of AI agents collaborating for weeks’ still can’t beat a human with a decent IDE and a clue. <a href="https://app.daily.dev/posts/gcgtwbk5H" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
