Cisco

Codrops

databricks

Fatbobman

Foojay.io

freeCodeCamp

<h2>Must know</h2>
<ul>
<li><strong>Critical Node.js vulnerability impacts major frameworks and APM tools</strong>: A critical denial-of-service vulnerability (CVE-2025-59466) in Node.js affects versions 8.x through 24.x, causing process crashes if <code>async_hooks</code> or <code>AsyncLocalStorage</code> are enabled. This impacts widely used frameworks like Next.js and React Server Components, as well as APM tools such as Datadog, New Relic, and OpenTelemetry. Node.js has released patches for supported versions, and immediate upgrades are crucial to prevent service downtime, as confirmed by Node.js release notes and Datadog advisories. <a href="https://app.daily.dev/posts/EyLXGRUe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ServiceNow AI agent vulnerability allowed full user impersonation</strong>: A critical vulnerability, dubbed BodySnatcher (CVE-2025-12420), was discovered in ServiceNow’s Virtual Agent AI platform. This flaw allowed unauthenticated attackers to impersonate any user using only an email address, bypassing passwords and MFA. The exploit could lead to admin account creation, access to connected modules (HR, customer service), and privilege escalation. ServiceNow has since issued a patch, rotated credentials, and removed the exploited AI agent functionality, highlighting the risks of rapidly integrating AI agents without robust security, according to AppOmni and ServiceNow. <a href="https://app.daily.dev/posts/wzAqd15ET" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Patch Tuesday addresses critical zero-day and Secure Boot flaws</strong>: Microsoft’s January 2026 Patch Tuesday includes critical security updates for 112-114 vulnerabilities. Notably, CVE-2026-20805, a zero-day in Desktop Window Manager, is actively exploited to bypass ASLR, increasing risk in exploit chains. CISA has added this to its Known Exploited Vulnerabilities catalog, mandating federal patching. Additionally, fixes for expiring Secure Boot certificates from 2011 and 2026 are included, alongside multiple Office RCE vulnerabilities, as reported by Krebs on Security and BleepingComputer. <a href="https://app.daily.dev/posts/Kwy6WAbQP" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Databricks partnerships enhance AI-driven data insights</strong>: Atlassian Rovo now integrates with Databricks AI/BI Genie for natural language queries, while Algonomy launched RetailAI on Databricks for agentic retail planning, both aiming to democratize data access and reduce technical barriers. <a href="https://app.daily.dev/feed-by-ids?id=2XKWuVI4o&amp;id=8pU7lXz1A" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>U.S. federal agencies prepare for quantum security migration</strong>: U.S. federal agencies, including the FBI, NIST, and CISA, are moving from awareness to implementation of post-quantum cryptography (PQC) standards to counter ‘harvest now, decrypt later’ attacks, urging immediate inventory of cryptographic assets. <a href="https://app.daily.dev/posts/lRZsyJgWP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New Rails engine monitors LLM API usage and costs</strong>: RubyLLM::Monitoring is a new Rails engine that tracks LLM API usage, costs, performance, and errors, providing a dashboard and configurable alerts for cost management and optimization within Rails applications. <a href="https://app.daily.dev/feed-by-ids?id=oYtsCmpWz&amp;id=ypxl4mcW2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firefox 147 and Thunderbird 147 released with new features</strong>: Firefox 147 introduces automatic Picture-in-Picture, enhanced WebGPU support for Apple Silicon, and zero-copy hardware video playback for AMD GPUs, while Thunderbird 147 adds folder path options and optional localization. <a href="https://app.daily.dev/posts/f7pzHnDhN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel Compute Runtime adds support for new GPUs</strong>: Intel’s Compute Runtime version 26.01.36711.4 introduces initial support for Crescent Island and Nova Lake S graphics hardware, continuing Level Zero and OpenCL API support for Intel GPUs. <a href="https://app.daily.dev/posts/54Uqeadiv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quantum dot breakthrough for telecom C-band communication</strong>: Researchers developed a single-photon source using InAs quantum dots operating in the telecom C-band, achieving 91.7% two-photon interference visibility, a record for solid-state sources in this range, promising practical quantum networks. <a href="https://app.daily.dev/posts/woujp8xYd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bandcamp bans substantially AI-generated music</strong>: Bandcamp announced a ban on music created wholly or substantially by AI, effective January 2026, aiming to protect human artists and ensure authenticity, a move that diverges from platforms like Spotify. <a href="https://app.daily.dev/feed-by-ids?id=LZT0kWKSj&amp;id=wgoMt7tqL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI coding tools: still not replacing senior engineers, shocker</strong>: Turns out, those fancy LLM coding tools are still slow, need a babysitter, and don’t magically make senior developers 10x more productive. While they might help junior devs or non-coders, senior engineers are finding AI-generated code functionally correct but architecturally unsound, especially in complex domains like Android development. So, if you thought AI was going to write your next production-ready mobile app, you might want to temper those expectations, as detailed in ‘The Insecure Evangelism of LLM Maximalists’ and various developer critiques. <a href="https://app.daily.dev/feed-by-ids?id=IcLyTC7xk&amp;id=O3swuQWEt&amp;id=WndZlg59o&amp;id=XTzlp2ZQd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated technical books: the new spam you didn’t ask for</strong>: HiTeX Press, a true innovator in the field of ‘quantity over quality,’ has managed to churn out over 800 AI-generated technical books in a single year. These masterpieces, available on Amazon, feature fabricated code, non-existent features, and are generally meaningless. It’s a brilliant strategy to pollute the technical publishing landscape and make it even harder for actual learners to find reliable information. Who needs human authors when you have an AI that can hallucinate an entire library? <a href="https://app.daily.dev/posts/PmK6l9z8J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor’s dynamic context discovery: because 46.9% less tokens is a ‘breakthrough’</strong>: Cursor, an AI code editor, is touting ‘dynamic context discovery’ as a revolutionary way to save 46.9% on LLM tokens. Apparently, feeding the AI only what it needs, when it needs it, is a novel concept. While reducing token usage is nice for cost and speed, framing this as a groundbreaking advancement rather than basic optimization for LLM interactions feels a bit like celebrating a car that finally gets decent gas mileage. Let’s see if it actually makes the AI less confused or just cheaper to confuse. <a href="https://app.daily.dev/feed-by-ids?id=gz0G04ehE&amp;id=nGGCLLBtk" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
