<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are affecting JavaScript package managers like npm and yarn, allowing attackers to bypass security controls and deliver malicious payloads. While pnpm, vlt, and Bun have already patched these flaws, npm claims the behavior is 'by design,' leaving millions of developers exposed. Oren Yomtov, the researcher who disclosed these, strongly advises migrating to patched alternatives, as reported by multiple security outlets. This is a critical vulnerability for frontend and fullstack engineers relying on these tools. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day forces emergency patch</strong>: Microsoft has issued an emergency out-of-band patch for a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office, actively exploited in the wild. The flaw, with a CVSS score of 7.8, allows attackers to bypass security protections via malicious Office files. While newer versions are patched, Office 2016 and 2019 users need manual registry workarounds. CISA has mandated federal agencies patch this by February 16, 2026, highlighting the urgency of this threat, as reported by security news. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare launches serverless post-quantum Matrix homeserver</strong>: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, leveraging a serverless architecture and post-quantum cryptography (X25519MLKEM768) by default. This aims to protect data from 'harvest-now-decrypt-later' attacks and offers end-to-end encrypted messaging with sub-50ms global latency for less than $1/month. However, a Matrix homeserver developer criticized the implementation for lacking critical security features like authorization checks and state resolution, calling it incomplete and potentially AI-generated, as reported by Cloudflare and a critical review. <a href="https://app.daily.dev/feed-by-ids?id=vURH9h7xw&amp;id=93HDTbjA4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Go language team proposes generic methods</strong>: The Go team has proposed adding generic methods to the language, allowing type parameters on concrete methods for improved code organization and readability, while maintaining backward compatibility. <a href="https://app.daily.dev/posts/W8OOKuC86" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI coding agents reshape developer roles</strong>: AI coding agents are shifting developer roles from hands-on coding to product architecture and outcome engineering, requiring new infrastructure for orchestration and fault tolerance, with companies like Temporal positioning themselves as key providers. <a href="https://app.daily.dev/feed-by-ids?id=b2fEANN64&amp;id=yBxtGCVqr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Alibaba Cloud releases Qwen3-Max-Thinking AI model</strong>: Alibaba Cloud launched Qwen3-Max-Thinking, an enterprise AI reasoning model claiming performance on par with GPT-5.2-Thinking and Claude-Opus-4.5, featuring adaptive tool use and test-time scaling, particularly relevant for Asia Pacific enterprises. <a href="https://app.daily.dev/posts/NV9ulemJA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Amazon Bedrock extends prompt cache duration for Claude models</strong>: Amazon Bedrock now offers a 1-hour prompt caching option for select Anthropic Claude models (Sonnet 4.5, Haiku 4.5, Opus 4.5), improving cost efficiency and performance for long-running agentic workflows. <a href="https://app.daily.dev/posts/eXJDrlIIv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KPHP: <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a>’s open-source PHP compiler</strong>: <a href="http://VK.com" target="_blank" rel="noopener nofollow">VK.com</a> has open-sourced KPHP, a PHP compiler that transpiles a restricted subset of PHP to C++ for 3-10x speed improvements, offering compile-time type inference and optimizations. <a href="https://app.daily.dev/posts/801wep0xd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Script language preview targets high-performance JavaScript</strong>: Script, a new programming language, aims to compile JavaScript and TypeScript to native machine code using LLVM and Cranelift, offering Rust-style memory safety and up to 8x performance improvements over Node.js in compute-intensive tasks. <a href="https://app.daily.dev/posts/PpJc9MwUl" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Streaming JSON for responsive AI APIs</strong>: A new JavaScript technique allows progressive delivery of JSON data while maintaining validity, addressing challenges in streaming AI API outputs word-by-word for improved perceived performance. <a href="https://app.daily.dev/posts/yyfhP6ohw" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding agents: still more hype than help</strong>: OpenAI just released a technical breakdown of its Codex CLI coding agent, admitting it’s 'brittle and prone to errors' outside its training data and still requires human oversight. Meanwhile, a developer built a browser from scratch with an LLM agent in 72 hours, proving that one human with one AI is better than hundreds of autonomous agents. So much for AI replacing us all, it seems we still need humans to clean up the mess. <a href="https://app.daily.dev/feed-by-ids?id=qZX3wHxMK&amp;id=AVhV6Ry0N" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI ethics: all talk, no trousers</strong>: Turns out, all those fancy AI ethics frameworks and governance principles are mostly for show. Major tech companies are busy lobbying to water down regulations like the EU AI Act and even dismantling their own ethics teams. With examples like the Dutch childcare fraud and Australia’s Robodebt, it’s clear that while the principles proliferate, vulnerable groups remain unprotected. Who needs ethics when you have profits, right? <a href="https://app.daily.dev/posts/lKscHPRX8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Context engineering: new name, same RAG</strong>: Apparently, Retrieval-Augmented Generation (RAG) is now too passé, so we’re rebranding it as 'context engineering.' This new, broader field supposedly encompasses RAG and MCP, driven by the rise of agentic AI systems. Contextual AI even launched an 'Agent Composer' for enterprises. It’s almost like they’re trying to make old tech sound new and exciting to justify more funding. Hype cycle, anyone? <a href="https://app.daily.dev/posts/tHZI0osnL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
