<h2>Must know</h2>
<ul>
<li><strong>Microsoft Office zero-day vulnerability actively exploited</strong>: Microsoft issued an emergency patch for CVE-2026-21509, a zero-day vulnerability in Office with a CVSS score of 7.8. This flaw bypasses security features for legacy COM and OLE components, allowing attackers to execute code via malicious Office files. While newer Office versions and Microsoft 365 Apps received immediate updates, Office 2016 and 2019 users need manual registry workarounds. CISA has mandated federal agencies patch by February 16, highlighting the urgency of this actively exploited threat. <a href="https://app.daily.dev/feed-by-ids?id=qC937DXHe&amp;id=qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-driven polymorphic phishing evades traditional detection</strong>: A new phishing attack uses AI models like DeepSeek and Gemini to generate malicious JavaScript directly in victims’ browsers. This technique fragments malware and reassembles it client-side from trusted LLM domains, bypassing static payload detection. While existing email security and secure web gateways offer partial protection, the ‘last mile reassembly’ makes traditional signature-based detection ineffective, emphasizing the need for increased user awareness. <a href="https://app.daily.dev/posts/jfmiKNwaJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Laravel Livewire RCE vulnerability leads to mass compromises</strong>: Multiple Laravel websites have been compromised due to a probable Remote Code Execution (RCE) vulnerability in Livewire versions prior to 3.6.4. The exploit leverages improper serialized data handling, allowing attackers to execute code, deploy PHP backdoors, and install CPU cryptominers. Attackers are bypassing standard Laravel routing and middleware by running files directly from the public/ directory. Immediate mitigation includes upgrading Livewire, securing APP_KEY, and restricting public/ directory permissions. <a href="https://app.daily.dev/feed-by-ids?id=dsQkjC4Yj&amp;id=dsQkjC4Yj&amp;id=dsQkjC4Yj" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Google expands Android anti-theft protections</strong>: Google is rolling out new anti-theft features for Android 16+, including Failed Authentication Lock, expanded Identity Check coverage, and an optional security challenge for Remote Lock. In Brazil, AI-powered Theft Detection Lock and Remote Lock will be enabled by default, aiming to strengthen security and theft prevention. <a href="https://app.daily.dev/posts/a8ZBOybpX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents transform coding workflows</strong>: Andrej Karpathy reports shifting from 80% manual coding to 80% AI agent-assisted coding, primarily using LLMs like Claude, enabling higher-level code actions and fundamentally altering traditional software development. While AI agents offer significant productivity gains, concerns about skill atrophy and agents making incorrect assumptions remain. <a href="https://app.daily.dev/feed-by-ids?id=vRs04mdPH&amp;id=vRs04mdPH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust Foundation releases 2025 annual report and strategic plan</strong>: The Rust Foundation’s 2025 annual report and 2026-2028 strategic plan prioritize stable infrastructure, sustainable maintainer support, responsible adoption growth, and community engagement, having raised $5.1 million and invested $2.7 million into the Rust Project in 2025. <a href="https://app.daily.dev/posts/DRpplNBlF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel project formalizes succession plan</strong>: The Linux kernel project has formalized a succession plan for leadership after Linus Torvalds’ eventual departure, ensuring continuity by outlining a process for maintainers to select new leadership, addressing concerns about an aging community. <a href="https://app.daily.dev/posts/vAKZlS9Qz" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WhatsApp adopts Rust for global media security overhaul</strong>: WhatsApp replaced 160,000 lines of C++ code with 90,000 lines of Rust in its media handling stack, deploying a new media consistency library called Kaleidoscope to validate media files and detect malicious patterns, affecting billions of users worldwide. <a href="https://app.daily.dev/posts/2YIPmtHiF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Cloud launches N4A instances with Axion ARM CPUs</strong>: Google Cloud has released N4A compute instances powered by custom Axion ARM processors (Neoverse N3 cores), offering up to 64 vCPUs and 512GB RAM, targeting web servers, microservices, and containerized applications with improved performance and cost-effectiveness over previous T2A instances. <a href="https://app.daily.dev/feed-by-ids?id=JvBjVyZ5U&amp;id=JvBjVyZ5U" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Convex launches open source sponsorship program</strong>: Convex has initiated a formal program to offer credits to open source projects, prioritizing those it depends on, and plans to gradually release platform components for self-hosting, reinforcing its commitment to the open source community. <a href="https://app.daily.dev/feed-by-ids?id=6mIKq6JaH&amp;id=6mIKq6JaH" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated code: the gift that keeps on giving… technical debt</strong>: Turns out, those shiny AI coding agents, like Sonnet 4.5, are great at churning out code quickly, but not so great at quality. According to some experiment, they’re producing ‘spaghetti’ code with non-idiomatic patterns and subtle semantic errors, especially in Swift. So, while you might get functional output, you’re also getting a hefty dose of technical debt. Guess human oversight is still ‘essential and irreplaceable’ after all, who would’ve thought? <a href="https://app.daily.dev/feed-by-ids?id=uilUGnhp4&amp;id=uilUGnhp4&amp;id=fPZ532s1X&amp;id=fPZ532s1X" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor’s AI browser: ‘from scratch’ means ‘heavily dependent’ and ‘barely compiles’</strong>: Cursor announced a ‘major AI software engineering breakthrough’—an AI-built web browser with 3 million lines of code and a custom Rust rendering engine, supposedly ‘from scratch.’ Developers who actually looked at the code found it to be ‘spaghetti,’ failing to compile, and heavily reliant on existing external projects. So, ‘from scratch’ apparently means ‘we glued a bunch of other people’s code together with AI and it mostly doesn’t work.’ Impressive. <a href="https://app.daily.dev/feed-by-ids?id=gcgtwbk5H&amp;id=gcgtwbk5H&amp;id=gcgtwbk5H" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare’s serverless Matrix homeserver: ‘fundamentally broken’ but hey, it’s serverless!</strong>: Cloudflare proudly announced a Matrix homeserver running on its Workers platform, touting ‘zero maintenance’ and low cost. Matrix developers, however, quickly pointed out it lacks ‘fundamental security features’ like authorization checks and state resolution, calling it ‘fundamentally broken’ and possibly ‘AI-generated.’ Apparently, ‘serverless’ now means ‘we’ve offloaded all the critical security and functionality to the user, and it’s probably more expensive than a VPS.’ Progress! <a href="https://app.daily.dev/feed-by-ids?id=93HDTbjA4&amp;id=93HDTbjA4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
