Changelog

Cisco

Fatbobman

Fireship

GitHub Blog

Hacker News

<h2>Must know</h2>
<ul>
<li><strong>Critical DoS vulnerability in Node.js async_hooks</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) has been discovered in Node.js, affecting versions 8.x through 24.x. This flaw causes process crashes due to uncatchable stack overflows when <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled, impacting major frameworks like Next.js and React Server Components, as well as APM tools like Datadog. Node.js has released patches for supported versions, and immediate upgrades are recommended to prevent service downtime. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full impersonation</strong>: A critical vulnerability, dubbed ‘BodySnatcher’ (CVE-2025-12420), was found in ServiceNow’s Virtual Agent AI platform. This flaw allowed unauthenticated attackers to impersonate any user, bypassing MFA and passwords, simply by knowing an email address. The exploit could lead to admin account creation, privilege escalation across connected modules, and rogue AI agents. ServiceNow has patched the issue, rotated credentials, and removed the exploited AI agent functionality, highlighting the systemic risks of rapidly integrating AI agents without robust security controls. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday addresses critical zero-day</strong>: Microsoft’s January 2026 Patch Tuesday includes critical security updates for 112-114 vulnerabilities, with eight labeled as critical. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR and leak memory addresses. CISA has added this to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch by February 3, 2026. Other fixes address Office RCEs and Secure Boot certificate expirations, as reported by Krebs on Security and The Hacker News. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>U.S. federal agencies prepare for quantum security migration</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to implementation of quantum security practices, focusing on migrating to post-quantum cryptography (PQC) to counter ‘harvest now, decrypt later’ threats. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI code editor Cursor optimizes token usage</strong>: Cursor, an AI code editor, introduced dynamic context discovery to reduce LLM token consumption by 46.9% by accessing code context only when needed, aiming for lower operational costs and faster AI response times. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Databricks expands AI partnerships for data insights</strong>: Databricks is partnering with Atlassian Rovo for natural language queries on enterprise data and Algonomy for AI-driven retail planning, aiming to democratize data access and move businesses towards predictive operations. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rails engine monitors LLM API usage and costs</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and error rates within applications, providing a dashboard and configurable alerts for cost management and optimization. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 released with new features</strong>: Firefox 147 introduces automatic Picture-in-Picture, reorganized tab settings, enhanced WebGPU support for Apple Silicon, zero-copy hardware video playback for AMD GPUs on PC, and XDG Base Directory support for Linux. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Compute Runtime adds new GPU support</strong>: Intel’s Compute Runtime version 26.01.36711.4 now includes initial support for Crescent Island and Nova Lake S graphics hardware, continuing support for Level Zero and OpenCL APIs. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quantum dot breakthrough for telecom C-band</strong>: Researchers have developed a single-photon source using InAs quantum dots operating in the telecom C-band, achieving 91.7% two-photon interference visibility, a record for solid-state sources in this range, potentially enabling practical quantum networks. <a href="https://app.daily.dev/posts/woujp8xYd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: the new insider threat, now with physical capabilities</strong>: Apparently, AI agents are not just a digital menace; they’re now insider threats with elevated privileges, susceptible to prompt injection, and can even compromise humanoid robots via voice commands. Researchers have demonstrated that these compromised robots can then propagate attacks to nearby devices. So, not only do we have to worry about our data, but now our robot overlords might turn on us because someone whispered the wrong thing, as if human error wasn’t already enough of a problem. <a href="https://app.daily.dev/feed-by-ids?id=MpJOJGOmA&amp;id=bwVFAnzEc&amp;id=c8Xk5dH7c" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>LLM maximalists still pushing the ‘AI will code everything’ dream</strong>: Some senior developers are still out there, critiquing LLM coding tools as slow, requiring excessive supervision, and not actually boosting productivity for experienced programmers. Yet, the ‘LLM maximalists’ continue to evangelize, dismissing skepticism as resistance to change. It seems the dream of AI replacing all coding is still just that—a dream, especially when AI-generated code is functionally correct but architecturally deficient, as noted in Android development reviews. <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated technical books: the new frontier of publishing spam</strong>: HiTeX Press has apparently mastered the art of industrial-scale spam, releasing over 800 AI-generated technical books in a single year, complete with fabricated code and non-existent features. These masterpieces, priced at 8€ each, are flooding major platforms like Amazon, making it nearly impossible for actual learners to find legitimate resources. Who needs quality control when you have quantity, right? It’s a brilliant strategy if your goal is to completely erode trust in technical publishing. <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
