<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are actively affecting JavaScript package managers like npm and yarn, allowing attackers to bypass security controls designed to prevent worm attacks. While pnpm, vlt, and Bun have already released patches, npm and yarn have not, with npm claiming the behavior is ‘by design.’ Researcher Oren Yomtov strongly advises developers to migrate to patched package managers to avoid potential malicious payload delivery. This highlights a critical security gap in widely used tools, forcing developers to choose between convenience and security. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day forces emergency patch</strong>: Microsoft has issued an emergency out-of-band patch for a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office, actively exploited in the wild. The flaw, a security feature bypass with a CVSS score of 7.8, allows attackers to circumvent protections against unsafe legacy COM and OLE components using malicious Office files. While newer versions are patched, Office 2016 and 2019 users must rely on manual registry workarounds, and CISA has mandated federal agencies patch by February 16, 2026. This underscores the persistent risk from legacy components and the urgency of patching. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Teleport unveils agentic identity framework for AI security</strong>: Teleport has launched a new Agentic Identity Framework designed to secure AI agents by applying cryptographic authentication instead of traditional static credentials. This framework introduces a unified identity layer, hardware-based root of trust, and zero-trust authentication, ensuring agents only access resources when needed. It also includes robust audit trails, governance tools, and prompt tracking to detect injection attacks, directly addressing the rising threat of AI agent compromise due to their access to sensitive data and autonomous execution capabilities. <a href="https://app.daily.dev/posts/CI1C8FH63" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>AI agents reshape developer roles and enterprise operations</strong>: AI agents are shifting developer roles from coding to product architecture and outcome engineering, creating new infrastructure needs for orchestration and fault tolerance, with companies like Temporal positioning themselves as critical providers for production-level AI systems. <a href="https://app.daily.dev/feed-by-ids?id=b2fEANN64&amp;id=yBxtGCVqr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Enterprises move AI inference to private clouds</strong>: Enterprises are increasingly shifting AI inference workloads from public to private clouds due to escalating costs, reliability concerns, and the need for proximity to core business processes, emphasizing predictable compute capacity and data locality. <a href="https://app.daily.dev/posts/y3MccvMQQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare launches serverless, post-quantum Matrix homeserver</strong>: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, leveraging a serverless architecture with post-quantum cryptography to protect against ‘harvest-now-decrypt-later’ attacks, offering end-to-end encrypted messaging with sub-50ms global latency for less than $1/month. <a href="https://app.daily.dev/posts/vURH9h7xw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go language team proposes generic methods</strong>: The Go team has proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability, with a focus on backward compatibility and static compile-time resolution. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vinted automates Vespa search maintenance using Temporal</strong>: Vinted replaced manual Bash scripts with Temporal for managing its Vespa search engine operations, enabling fault-tolerant orchestration, zero-impact upgrades, and self-service operations for engineers, significantly reducing operational toil. <a href="https://app.daily.dev/posts/psgDmdeNF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>LinkedIn engineers tackle agentic RL training for GPT-OSS</strong>: LinkedIn’s engineering team addressed critical issues in agentic reinforcement learning for the GPT-OSS model, including log-probability mismatches and memory inefficiencies, resulting in stable training for multi-step decision-making tasks. <a href="https://app.daily.dev/posts/CAykziagK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks SQL 2025 performance enhancements</strong>: Databricks announced significant performance improvements for Databricks SQL in 2025, including up to 40% faster production workloads, 10x reduction in Unity Catalog latency, and 30% faster Delta Sharing queries, all automatically applied in DBSQL Serverless. <a href="https://app.daily.dev/posts/rT9ZMYOFd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Cloudflare’s Matrix homeserver: a masterclass in ‘how not to’</strong>: Cloudflare, in its infinite wisdom, announced a Matrix homeserver implementation on its Workers platform. A Matrix developer quickly pointed out it lacks critical security features like authorization and state resolution, is full of TODOs, and would cost more than a standard VPS. Apparently, Cloudflare’s idea of ‘innovation’ is releasing something half-baked and potentially AI-generated, then calling it a day. Maybe they should stick to CDNs and leave actual software to people who understand security and cost. <a href="https://app.daily.dev/posts/93HDTbjA4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ricursive Intelligence: the $4 billion startup that does… something with AI chips?</strong>: Ricursive Intelligence, founded by ex-Google researchers, just snagged $300 million at a $4 billion valuation, two months after launch. Their grand plan? An AI system to design and improve AI chips. No products, no public statements from founders, just a lot of hype and a vague claim about ‘AlphaChip’ being used in Google’s TPUs. It’s almost as if venture capitalists are throwing money at anything with ‘AI’ and ‘chip’ in the same sentence, regardless of actual substance. What could possibly go wrong? <a href="https://app.daily.dev/posts/pqGutcjN8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI ethics: more talk, less action, same old problems</strong>: Turns out, all those fancy AI ethics frameworks and governance principles are mostly for show. While tech companies spend millions lobbying to water down regulations, they’re simultaneously dismantling their internal ethics teams. Meanwhile, vulnerable populations are still getting screwed by algorithmic systems, like in the Dutch childcare fraud scandal. It’s almost like ‘AI ethics’ is just a convenient distraction while the powerful consolidate control and avoid any real accountability. Who needs protection when you have principles, right? <a href="https://app.daily.dev/posts/lKscHPRX8" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
