<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are affecting JavaScript package managers like npm and yarn, allowing attackers to bypass security controls designed to prevent worm attacks. While pnpm, vlt, and Bun have released patches, npm and yarn have not, with npm claiming the behavior is by design. Researcher Oren Yomtov strongly advises developers to migrate to patched package managers to avoid potential malicious payload delivery, as reported by multiple sources. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day forces emergency patch</strong>: Microsoft issued an emergency out-of-band patch for a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office, actively exploited in the wild. The flaw, a security feature bypass, allows attackers to circumvent protections against legacy COM and OLE components using malicious Office files. While newer Office versions are patched, Office 2016 and 2019 users must rely on manual registry workarounds, and CISA has mandated federal agencies patch by February 16, 2026, as reported by Microsoft and CISA. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ShinyHunters target Okta SSO credentials at major tech firms</strong>: The cybercriminal group ShinyHunters is conducting a credential-theft campaign targeting around 100 organizations, including Canva, Atlassian, RingCentral, and ZoomInfo. The attacks leverage Okta single sign-on (SSO) accounts through voice-phishing (vishing) and advanced social engineering to trick employees into revealing MFA credentials, allowing attackers to enroll their own devices for persistent access and data exfiltration. Security researchers strongly recommend using phishing-resistant MFA like FIDO2 security keys or passkeys, as reported by security researchers. <a href="https://app.daily.dev/posts/Z5ZlrJvjT" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Go language team proposes generic methods</strong>: The Go team has proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability, with full backward compatibility and static compile-time resolution. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare launches serverless post-quantum Matrix homeserver</strong>: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, offering a serverless architecture with X25519MLKEM768 post-quantum cryptography by default, end-to-end encryption, and sub-50ms global latency for under $1/month. <a href="https://app.daily.dev/posts/vURH9h7xw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Teleport unveils agentic identity framework for AI agent access</strong>: Teleport launched a new Agentic Identity Framework that uses cryptographic authentication and zero-trust principles for AI agents, providing secure identities, least-privileged access, real-time monitoring, and prompt tracking to combat prompt injection attacks. <a href="https://app.daily.dev/posts/CI1C8FH63" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust Foundation expands funding and outlines 2026-2028 strategy</strong>: The Rust Foundation raised $5.1 million in 2025, investing $2.7 million into the Rust Project, and has outlined a 2026-2028 strategy focusing on stable infrastructure, sustainable maintainer support, and responsible adoption growth. <a href="https://app.daily.dev/posts/y4jhOcrNg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Hybrid use of Rust and JavaScript/TypeScript in modern software architectures</strong>: Modern software architectures increasingly combine Rust for performance-critical system-level components and JavaScript/TypeScript for rapid UI development, often leveraging WebAssembly for seamless integration, as seen in companies like Figma and Cloudflare. <a href="https://app.daily.dev/posts/UAEJhL6mu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ESLint v10.0.0-rc.2 release and highlights</strong>: ESLint v10.0.0-rc.2, a release candidate, is now available for testing, fixing a regression in the strict rule’s global mode report range and updating the esquery dependency, with a migration guide provided for upgrading. <a href="https://app.daily.dev/posts/EfrDMwvxT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KPHP: open-source PHP compiler by <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a></strong>: <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a>’s KPHP is an open-source PHP compiler that transpiles a restricted subset of PHP to C++ for native binaries, offering 3-10x speed improvements over standard PHP with compile-time type inference and optimizations, though it lacks support for dynamic features. <a href="https://app.daily.dev/posts/801wep0xd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding agents: still not replacing humans, just making more work</strong>: OpenAI’s latest technical breakdown of Codex CLI admits their AI coding agents are ‘brittle and prone to errors’ and still ‘require human oversight,’ especially for production. Meanwhile, experiments with Swift projects show AI-generated code often violates language idioms and introduces unnecessary complexity, leading to technical debt. So, while AI can churn out code, it seems we’re still stuck cleaning up its messes, proving that the ‘human in the loop’ is less about guidance and more about damage control. <a href="https://app.daily.dev/feed-by-ids?id=qZX3wHxMK&amp;id=uilUGnhp4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI ethics: all talk, no trousers</strong>: Despite a ‘proliferation’ of AI ethics frameworks, major tech companies are busy lobbying to dilute regulations like the EU AI Act and even dismantling their own internal ethics teams. Apparently, principles are great for PR, but actual protections for vulnerable groups? Not so much. It’s almost as if ‘human-centric AI’ means ‘human-centric profits’ for the few, while the rest of us get to deal with algorithmic harms and fragmented governance, as highlighted by the Dutch childcare fraud scandal. Who needs ethics when you have lobbyists? <a href="https://app.daily.dev/posts/lKscHPRX8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ChatGPT cites AI-generated Grokipedia: the echo chamber is real</strong>: ChatGPT’s GPT-5.2 model has been caught citing Elon Musk’s AI-generated Grokipedia as a source, raising concerns about feedback loops amplifying biases and misinformation. OpenAI claims to have filters for low-credibility sources, but apparently, an AI citing another AI’s unverified content slipped right through. It’s a brave new world where our AI overlords are just making stuff up and then citing each other as proof. What could possibly go wrong? <a href="https://app.daily.dev/posts/fWRmbZwbT" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
