<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are actively affecting JavaScript package managers like npm and yarn, allowing attackers to bypass security controls designed to prevent worm attacks. While pnpm, vlt, and Bun have already released patches, npm and yarn have yet to do so, with npm claiming the behavior is ‘by design.’ Researcher Oren Yomtov strongly advises developers to migrate to patched package managers to avoid potential malicious payload delivery. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day forces emergency patch</strong>: Microsoft issued an emergency out-of-band patch for a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office, actively exploited in the wild. The flaw, a security feature bypass, allows attackers to use malicious Office files to circumvent protections against unsafe legacy COM and OLE components. While newer Office versions are patched, Office 2016 and 2019 users must rely on manual registry workarounds, and CISA has mandated federal agencies patch by February 16, 2026. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ingress-nginx archived, time to migrate to Cilium</strong>: The ingress-nginx project is being archived in early 2026, meaning no more maintenance or security updates. If you’re using it, you need to migrate. Cilium offers two paths: a quick drop-in replacement with Cilium Ingress, or a more advanced, Kubernetes-standard Gateway API implementation for better traffic management. Both leverage Cilium’s eBPF datapath for performance and observability, and migration tools are available. <a href="https://app.daily.dev/posts/PptBbhnAu" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Go team proposes generic methods</strong>: The Go team has proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability, with full backward compatibility. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust Foundation expands funding and strategy</strong>: The Rust Foundation raised $5.1 million in 2025, investing $2.7 million into the Rust Project, and outlined a 2026-2028 strategy focusing on stable infrastructure, maintainer support, and responsible adoption growth. <a href="https://app.daily.dev/posts/y4jhOcrNg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare launches serverless post-quantum Matrix homeserver</strong>: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, offering a serverless, post-quantum cryptography-enabled solution with end-to-end encryption and sub-50ms global latency for under $1/month. <a href="https://app.daily.dev/posts/vURH9h7xw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Teleport unveils agentic identity framework for AI security</strong>: Teleport launched a new Agentic Identity Framework that uses cryptographic authentication for AI agents, providing zero-trust access, hardware-based root of trust, and real-time monitoring to secure AI agent access to infrastructure. <a href="https://app.daily.dev/posts/CI1C8FH63" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS Network Firewall adds GenAI traffic controls</strong>: AWS Network Firewall now supports web category-based filtering for generative AI application traffic, allowing security teams to block or restrict access to GenAI services at the network level and enforce compliance. <a href="https://app.daily.dev/posts/AdbvgaiZY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KPHP: <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a>’s open-source PHP compiler</strong>: <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a> has open-sourced KPHP, a PHP compiler that transpiles a restricted subset of PHP to C++ for 3-10x speed improvements, offering compile-time type inference and optimizations for performance-critical applications. <a href="https://app.daily.dev/posts/801wep0xd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Picolibc 1.8.11 improves RISC-V and POSIX support</strong>: Picolibc 1.8.11, a C standard library for embedded systems, has been released with enhanced support for RISC-V and Qualcomm Hexagon processors, along with improved POSIX compliance for greater portability. <a href="https://app.daily.dev/posts/XNeTbsf3f" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>D-Wave’s quantum leap: more usage, more contracts, still no actual quantum computer</strong>: D-Wave is touting ‘314% year-over-year growth’ in Advantage2 annealing system usage and a shiny new $10 million contract with an ‘undisclosed Fortune 100 company.’ They’re also promising a gate-model quantum system by 2026. Funny how these announcements always come directly from D-Wave, with no pesky third-party verification. It’s almost like they’re trying to convince investors, not deliver actual quantum computing breakthroughs. <a href="https://app.daily.dev/posts/B9UXF3b8Z" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ricursive Intelligence: the $4 billion startup that’s two months old and has no products</strong>: Ricursive Intelligence, founded by ‘former Google researchers,’ just snagged $300 million at a $4 billion valuation, two months after launch. Their big idea? An AI system to design and improve AI chips. Conveniently, there are no products, no public statements from founders, and no independent verification of their ‘AlphaChip’ claims. Sounds like another AI unicorn built on a foundation of pure speculation and investor FOMO. <a href="https://app.daily.dev/posts/pqGutcjN8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare’s Matrix homeserver: a masterclass in ‘how not to’</strong>: Cloudflare proudly announced a Matrix homeserver built on its Workers platform. A Matrix developer, however, quickly pointed out it lacks critical security features like authorization, is riddled with ‘TODO’ comments, and would cost more than a standard VPS. The expert even suggested it might be ‘partially AI-generated.’ So, Cloudflare’s big serverless Matrix reveal is less a breakthrough and more a cautionary tale in releasing half-baked, insecure tech. <a href="https://app.daily.dev/posts/93HDTbjA4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
