Arcjet

CNCF

Daily Dose of Data Science | Avi Chawla | Substack

ElixirStatus

Facebook Engineering


freeCodeCamp

<h2>Must know</h2>
<ul>
<li><strong>PackageGate zero-days expose npm and yarn to worm attacks</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are actively affecting npm and yarn, allowing attackers to bypass security controls designed to prevent worm attacks. While pnpm, vlt, and Bun have already patched these flaws, npm claims the behavior is ‘by design,’ leaving millions of JavaScript developers exposed. Security researcher Oren Yomtov strongly advises migrating to patched package managers immediately, as reported by multiple sources. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Office zero-day forces emergency patch</strong>: Microsoft has issued an emergency out-of-band patch for a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office, actively exploited in the wild. The flaw, a security feature bypass, allows attackers to circumvent protections against legacy COM and OLE components using malicious Office files. While newer versions are patched, Office 2016 and 2019 users must rely on manual registry workarounds, and CISA has mandated federal agencies patch by February 16, 2026, as reported by multiple sources. <a href="https://app.daily.dev/posts/qC937DXHe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ShinyHunters targets Okta SSO credentials at major tech firms</strong>: The cybercriminal group ShinyHunters is conducting a credential-theft campaign against approximately 100 organizations, including Canva, Atlassian, RingCentral, and ZoomInfo. The attacks leverage Okta single sign-on (SSO) accounts through voice-phishing (vishing) and advanced social engineering to enroll attacker-controlled devices in victims’ multi-factor authentication (MFA) solutions, leading to sensitive data exfiltration. Security researchers strongly recommend using phishing-resistant MFA like FIDO2 security keys or passkeys, as reported by multiple sources. <a href="https://app.daily.dev/posts/Z5ZlrJvjT" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cloudflare launches serverless, post-quantum Matrix homeserver</strong>: Cloudflare has ported a full Matrix homeserver, Tuwunel, to its Workers platform, leveraging a serverless architecture with D1, KV, R2, and Durable Objects, and featuring X25519MLKEM768 post-quantum cryptography by default to protect against harvest-now-decrypt-later attacks. <a href="https://app.daily.dev/posts/vURH9h7xw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Teleport unveils agentic identity framework for AI agent access</strong>: Teleport launched a new Agentic Identity Framework that applies cryptographic authentication to AI agents, moving beyond static credentials with features like hardware-based root of trust, zero-trust authentication, and prompt tracking to combat prompt injection attacks. <a href="https://app.daily.dev/posts/CI1C8FH63" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CISA publishes federal guidance on post-quantum cryptography adoption</strong>: CISA has released guidance mapping NIST-standardized post-quantum cryptography (PQC) algorithms to enterprise hardware and software, directing federal agencies to procure PQC-capable products where solutions are available, though adoption gaps remain, especially for digital signatures and authentication. <a href="https://app.daily.dev/posts/5Lj7cpvbX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WhatsApp announces strict account settings for high-risk users</strong>: WhatsApp launched ‘Strict Account Settings’ for high-risk users like journalists, offering features such as automatic media blocking from unknown senders, silenced calls, two-step verification, and restricted profile visibility, in a move that follows a lawsuit against Meta regarding privacy claims. <a href="https://app.daily.dev/posts/0u5TXEYDl" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust at scale: an added layer of security for WhatsApp</strong>: WhatsApp replaced 160,000 lines of C++ with 90,000 lines of Rust to build Kaleidoscope, a media consistency library that protects billions of users from malware hidden in files, demonstrating Rust’s production-readiness at massive scale across diverse platforms. <a href="https://app.daily.dev/posts/2YIPmtHiF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>BellSoft launches hardened Java container images to address security concerns</strong>: BellSoft has launched hardened container images for Java workloads, claiming 95% fewer vulnerabilities than standard images by leveraging an Alpaquita Linux base layer, aiming to reduce attack surface for enterprises needing secure and compliant solutions. <a href="https://app.daily.dev/posts/TStmfPNYX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Confluent launches security and compliance trust center</strong>: Confluent introduced a Trust Center, a self-service portal providing access to SOC 2 reports, ISO certifications, and pre-vetted security questionnaires, along with an ‘Ask AI’ assistant, to expedite vendor due diligence and enhance transparency for security, privacy, and compliance documentation. <a href="https://app.daily.dev/posts/Gnw2tQ23G" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI use accelerates decline of public knowledge platforms</strong>: Apparently, AI models like ChatGPT and Claude are so good at problem-solving that developers are ditching Stack Overflow and Wikipedia, leading to a ‘78% drop in traffic’ for the former. The article warns this will create a ‘model collapse’ where future AIs train on increasingly AI-generated, unverified content. So, we’re trading communal knowledge for private, siloed, potentially hallucinated answers. Progress! <a href="https://app.daily.dev/posts/3Qlqmk7FI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ricursive Intelligence achieves $4B valuation months after inception</strong>: Ricursive Intelligence, founded by ex-Google researchers, just snagged $300 million at a $4 billion valuation, two months after launch. Their big idea? An AI system to design and improve AI chips. Because what the world really needs is more AI designing AI, especially when the company has no public products and its founders’ previous claims about ‘AlphaChip’ are, shall we say, unverified. Hype train, choo choo! <a href="https://app.daily.dev/posts/pqGutcjN8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Agentic AI’s impact on ESG and financial reporting compliance</strong>: Agentic AI is now being deployed in ESG and financial reporting compliance, transforming ‘manual, fragmented reporting’ into ‘unified, streamlined workflows.’ The article claims this will turn compliance into a ‘strategic business driver,’ conveniently omitting any discussion of risks, challenges, or actual real-world examples. It’s almost as if they want us to believe AI will magically solve all our regulatory headaches without any downsides. How quaint. <a href="https://app.daily.dev/posts/0j1vRAA68" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
