<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are affecting JavaScript package managers like npm and yarn, allowing attackers to bypass security controls designed to prevent worm attacks. While pnpm, vlt, and Bun have released patches, npm and yarn have not, with npm claiming the behavior is by design. Researcher Oren Yomtov strongly advises developers to migrate to patched package managers to avoid potential malicious payload delivery. This is a critical security alert for anyone in the JavaScript ecosystem. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day forces emergency patch</strong>: Microsoft has issued an emergency out-of-band patch for a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office, actively exploited in the wild. The flaw, a security feature bypass with a CVSS score of 7.8, allows attackers to circumvent protections against legacy COM and OLE components using malicious Office files. While newer versions are patched, Office 2016 and 2019 users must rely on manual registry workarounds, and CISA has mandated federal agencies patch by February 16, 2026. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare launches serverless post-quantum Matrix homeserver</strong>: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, leveraging a serverless architecture with D1, KV, R2, and Durable Objects. This implementation uses X25519MLKEM768 post-quantum cryptography by default, aiming to protect against harvest-now-decrypt-later attacks. It promises end-to-end encrypted messaging from the edge with sub-50ms global latency and minimal operational overhead, costing less than $1 per month for idle servers. However, a Matrix developer has criticized the implementation for lacking critical security features like authorization checks and state resolution, calling it incomplete and potentially AI-generated, and claiming it would be more expensive than standard VPS hosting. <a href="https://app.daily.dev/feed-by-ids?id=vURH9h7xw&amp;id=93HDTbjA4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Lennart Poettering founds Amutable for Linux integrity</strong>: Lennart Poettering, creator of systemd, has launched Amutable, a new company focused on bringing proactive, cryptographically verifiable integrity to Linux workloads, aiming to move away from reactive security models. <a href="https://app.daily.dev/feed-by-ids?id=MvN4zVQYR&amp;id=Wh06tKTVd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust Foundation expands funding and outlines 2026-2028 strategy</strong>: The Rust Foundation raised $5.1 million in 2025, investing $2.7 million into the Rust Project, and has outlined a 2026-2028 strategy focusing on stable infrastructure, sustainable maintainer support, and responsible adoption growth. <a href="https://app.daily.dev/posts/y4jhOcrNg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go language team proposes generic methods</strong>: The Go team has proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability, while maintaining backward compatibility. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Hybrid Rust and JavaScript/TypeScript architectures gain traction</strong>: Modern software architectures are increasingly combining Rust for performance-critical system-level components and JavaScript/TypeScript for rapid development and UI, often leveraging WebAssembly for seamless integration. <a href="https://app.daily.dev/posts/UAEJhL6mu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vinted automates Vespa search maintenance with Temporal</strong>: Vinted’s engineering team replaced Bash scripts with Temporal for managing its Vespa search engine operations, enabling fault-tolerant orchestration and zero-impact upgrades for its rapidly scaling infrastructure. <a href="https://app.daily.dev/posts/psgDmdeNF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CISA publishes federal guidance on post-quantum cryptography adoption</strong>: CISA has released guidance mapping NIST-standardized post-quantum cryptography algorithms to enterprise hardware and software, advising federal agencies to procure PQC-capable products where solutions are available, highlighting adoption gaps in digital signatures and authentication. <a href="https://app.daily.dev/posts/5Lj7cpvbX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open-source SERA coding agent models released by Ai2</strong>: The Allen Institute for AI (Ai2) has released SERA, an open-source family of coding agent models designed for customization and fine-tuning on private codebases, significantly reducing costs and making advanced coding agents more accessible to smaller teams. <a href="https://app.daily.dev/posts/J0iLEN79d" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents build a browser ‘from scratch’ (spoiler: they didn’t)</strong>: Cursor’s CEO proudly announced their AI agents built a fully functional web browser ‘from scratch’ in a week, generating over 3 million lines of code. Independent developers, however, quickly found the browser barely compiles, doesn’t work, and relies heavily on existing projects like Servo and QuickJS. So much for ‘from scratch’—it seems the AI is better at generating marketing hype than functional software, and the CEO is better at generating press releases than verifiable products. <a href="https://app.daily.dev/posts/gcgtwbk5H" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding assistants accelerate knowledge privatization (because open source is for suckers)</strong>: The latest ‘insight’ suggests LLM-powered coding assistants are increasingly trained on proprietary user data, leading to a decline in public knowledge sources like Stack Overflow. The author predicts market consolidation, paywalled programming knowledge, and employer-mandated LLM subscriptions. Because why have a vibrant, open-source community when you can have a few dominant AI providers hoarding all the good stuff and charging you for it? Progress! <a href="https://app.daily.dev/posts/3Qlqmk7FI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI ethics principles proliferate without substantive protections (shocking, I know)</strong>: Apparently, all those AI ethics frameworks and governance principles proliferating globally haven’t actually resulted in effective protection for vulnerable groups. Major tech companies are too busy lobbying to dilute regulations like the EU AI Act and dismantling their internal ethics teams. Who knew that self-regulation by profit-driven corporations wouldn’t magically solve systemic harms? It’s almost as if ‘ethics’ is just a buzzword until there are actual consequences. <a href="https://app.daily.dev/posts/lKscHPRX8" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
