<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are affecting JavaScript package managers like npm and yarn, allowing attackers to bypass security controls designed to prevent worm attacks. While pnpm, vlt, and Bun have already patched these flaws, npm claims the behavior is an intentional design choice, not a bug. Researcher Oren Yomtov strongly advises developers to migrate to patched package managers to avoid potential malicious payload delivery, as reported by multiple sources. This is a critical vulnerability for JavaScript developers, especially given npm’s dismissive response. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day forces emergency patch</strong>: Microsoft has issued an emergency out-of-band patch for a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office, actively exploited in the wild. The flaw, a security feature bypass with a CVSS score of 7.8, allows attackers to circumvent protections against legacy COM and OLE components using malicious Office files. While newer versions are patched, Office 2016 and 2019 users must rely on manual registry workarounds. CISA has mandated all federal agencies patch this by February 16, 2026, highlighting the urgency of this threat. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents reshape developer roles and enterprise operations</strong>: The rise of AI agents is fundamentally shifting developer roles from hands-on coding to product architecture and outcome engineering, as much of the execution is automated. This transition creates new infrastructure needs for orchestration and fault tolerance, with companies like Temporal positioning themselves as critical providers for production-level AI systems. Enterprises are increasingly embedding AI agents as integrated features, moving towards semi- or fully-autonomous ‘coworkers.’ However, this necessitates robust agent governance, accountability frameworks, and agent registries to prevent ‘agent sprawl’ and unpredictable outcomes, as highlighted by multiple industry analyses. <a href="https://app.daily.dev/feed-by-ids?id=b2fEANN64&amp;id=yBxtGCVqr" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Go language team proposes generic methods</strong>: The Go team has proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability, with full backward compatibility. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare launches serverless post-quantum Matrix homeserver</strong>: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, offering a serverless, post-quantum cryptographic solution for end-to-end encrypted messaging with sub-50ms global latency and minimal operational cost. <a href="https://app.daily.dev/posts/vURH9h7xw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust Foundation expands funding and outlines 2026-2028 strategy</strong>: The Rust Foundation raised $5.1 million in 2025, investing $2.7 million into the Rust Project, and has outlined a 2026-2028 strategy focusing on stable infrastructure, sustainable maintainer support, and responsible adoption growth. <a href="https://app.daily.dev/posts/y4jhOcrNg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Hybrid use of Rust and JavaScript/TypeScript in modern software architectures</strong>: Modern software architectures increasingly combine Rust for performance-critical system-level components and JavaScript/TypeScript for rapid development and UI, often leveraging WebAssembly for seamless integration. <a href="https://app.daily.dev/posts/UAEJhL6mu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Streaming JSON for responsive AI APIs</strong>: New techniques are emerging for streaming JSON data progressively while maintaining validity, primarily driven by the need for responsive, word-by-word output from AI APIs, with a JavaScript implementation requiring only about 200 lines of code. <a href="https://app.daily.dev/posts/yyfhP6ohw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS Network Firewall adds GenAI traffic controls</strong>: AWS Network Firewall now offers web category-based filtering for generative AI application traffic, allowing security teams to block or restrict access to GenAI services at the network level and enforce compliance. <a href="https://app.daily.dev/posts/AdbvgaiZY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ESLint v10.0.0-rc.2 released</strong>: ESLint v10.0.0-rc.2 is available for testing, featuring a fix for a strict rule regression, removal of fake exports, and updated esquery dependency, with a migration guide provided for upgrading. <a href="https://app.daily.dev/posts/EfrDMwvxT" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Cloudflare’s Matrix homeserver: a masterclass in how not to release open source</strong>: Cloudflare proudly announced a Matrix homeserver implementation on its Workers platform, touting serverless architecture and post-quantum crypto. However, a Matrix homeserver developer quickly pointed out it lacks critical security features like authorization, is riddled with TODOs, and would cost more than a standard VPS. Apparently, ‘serverless’ means ‘less security, more cost, and probably AI-generated code’ when Cloudflare is involved. Maybe they should stick to CDNs. <a href="https://app.daily.dev/posts/93HDTbjA4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents: still not ready for prime time, but getting there (maybe)</strong>: OpenAI’s technical breakdown of Codex CLI admits its AI coding agents are ‘brittle and prone to errors’ outside their training data, requiring human oversight. Meanwhile, Tinybird released an ‘Agent Skills’ package with 20 explicit rules to guide AI agents in building Tinybird projects, essentially admitting AI needs hand-holding to produce decent code. It seems the dream of fully autonomous, bug-free AI coding is still firmly in the ‘future’ category, despite all the hype. <a href="https://app.daily.dev/feed-by-ids?id=qZX3wHxMK&amp;id=cBAMqjLpD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ricursive Intelligence: the next big AI chip design unicorn (or just another hype cycle)?</strong>: Ricursive Intelligence, founded by ex-Google researchers, just snagged $300 million at a $4 billion valuation, two months after launch, to build an AI system that designs and improves AI chips. They’re compared to other multi-billion dollar startups with similar objectives, but with no products released and no independent verification of their ‘AlphaChip’ claims. It’s almost as if venture capitalists are throwing money at anything with ‘AI’ and ‘chip’ in the same sentence, hoping one of them sticks. What could possibly go wrong? <a href="https://app.daily.dev/posts/pqGutcjN8" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
