<h2>Must know</h2>
<ul>
<li>PackageGate zero-days expose npm and yarn to worm attacks: Six zero-day vulnerabilities, dubbed PackageGate, are affecting JavaScript package managers like npm and yarn, allowing attackers to bypass security controls designed to prevent worm attacks. While pnpm, vlt, and Bun have released patches, npm and yarn have not, with npm claiming the behavior is by design. Researcher Oren Yomtov strongly advises developers to migrate to patched package managers to mitigate the risk, as reported by multiple sources. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Microsoft Office zero-day forces emergency patch: Microsoft issued an emergency out-of-band patch for a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office, actively exploited in the wild. The flaw, with a CVSS score of 7.8, allows attackers to bypass security protections using malicious Office files. While newer versions are patched, Office 2016 and 2019 users must rely on manual registry workarounds, and CISA has mandated federal agencies patch by February 16, 2026, according to Microsoft and CISA disclosures. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>AI agents reshape developer roles and enterprise operations: The rise of AI agents is shifting developer roles from hands-on coding to product architecture and outcome engineering, as AI automates much of the execution. This creates new infrastructure needs for orchestration and fault tolerance, with companies like Temporal positioning themselves as critical providers. Enterprises are embedding AI agents as integrated features, moving towards semi- or fully-autonomous ‘coworkers,’ but face challenges in governance and avoiding ‘agent sprawl,’ as discussed in “What will AI do to your career?” and “How Agents are quietly transforming the Enterprise.” <a href="https://app.daily.dev/feed-by-ids?id=b2fEANN64&amp;id=yBxtGCVqr" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li>Go team proposes generic methods: The Go team has proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability, with full backward compatibility. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Cloudflare launches serverless post-quantum Matrix homeserver: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, using a serverless architecture with post-quantum cryptography to protect against harvest-now-decrypt-later attacks, offering sub-50ms global latency and costing less than $1/month for idle servers. <a href="https://app.daily.dev/posts/vURH9h7xw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Teleport unveils agentic identity framework for AI agent access: Teleport launched a new Agentic Identity Framework that uses cryptographic authentication and zero-trust principles to secure AI agents, providing real-time visibility, least-privileged access, and prompt tracking to combat prompt injection attacks. <a href="https://app.daily.dev/posts/CI1C8FH63" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Java ecosystem updates: security, releases, and features: JDK 27 is planned to include JEP 527 for post-quantum hybrid key exchange in TLS 1.3, Oracle issued its quarterly Critical Patch Update for multiple JDK versions, and GlassFish Grizzly 5.0 now supports JDK 21 and virtual threads. <a href="https://app.daily.dev/posts/FSeG8tJvi" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Rust and JavaScript/TypeScript in hybrid architectures: Hybrid software architectures are increasingly combining Rust for performance-critical system-level components and JavaScript/TypeScript for rapid development and UI, often leveraging WebAssembly for seamless integration, as seen in Figma and Cloudflare. <a href="https://app.daily.dev/posts/UAEJhL6mu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>ESLint v10.0.0-rc.2 released: ESLint v10.0.0-rc.2, a release candidate, is now available for testing, fixing a regression in the strict rule’s global mode report range and updating the esquery dependency, with a migration guide provided. <a href="https://app.daily.dev/posts/EfrDMwvxT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Picolibc 1.8.11 brings RISC-V, Hexagon updates, and POSIX improvements: Picolibc 1.8.11 has been released, enhancing support for RISC-V and Qualcomm Hexagon processors, and improving POSIX compliance for embedded C standard library development. <a href="https://app.daily.dev/posts/XNeTbsf3f" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li>D-Wave’s quantum computing roadmap: more hype than substance?: D-Wave is touting 314% year-over-year growth in Advantage2 usage and a $10 million contract, while simultaneously outlining an ‘accelerated’ gate-model roadmap to launch its first system in 2026. They also claim to be the only company developing all three core superconducting quantum technologies. This sounds less like a breakthrough and more like a desperate attempt to keep investors interested with a mix of vague growth metrics and self-proclaimed uniqueness, all based on their own press releases. Where’s the independent verification, D-Wave? Or is this just another quantum leap of faith? <a href="https://app.daily.dev/posts/B9UXF3b8Z" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Ricursive Intelligence: the $4 billion startup that appeared out of nowhere: Ricursive Intelligence, founded by ‘former Google researchers’ (because that’s always a good sign), just snagged $300 million at a $4 billion valuation, two months after launch. Their big idea? An AI that designs and improves AI chips. Apparently, these ‘founders’ also developed ‘AlphaChip,’ which was ‘reportedly used in Google’s TPU chips.’ ‘Reportedly’ is doing a lot of heavy lifting there. No products, no public statements from founders, just a massive valuation based on a vague promise and a lot of investor cash. Sounds like the perfect recipe for a bubble, or at least a very expensive PowerPoint presentation. <a href="https://app.daily.dev/posts/pqGutcjN8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Cloudflare’s Matrix homeserver: a serverless marvel or a half-baked mess?: Cloudflare proudly announced its serverless Matrix homeserver, Tuwunel, claiming it runs on Workers with post-quantum crypto and costs less than $1/month. However, a Matrix homeserver developer quickly pointed out it lacks critical security features like authorization, is full of TODOs, and would actually cost more than a standard VPS. The developer even suggested it might be ‘partially AI-generated.’ So, is it a groundbreaking innovation or just another example of a big tech company rushing out an incomplete product for PR points? I’m leaning towards the latter. <a href="https://app.daily.dev/feed-by-ids?id=93HDTbjA4&amp;id=vURH9h7xw" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>