The 10 biggest things in tech, Sat, Jun 13
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
US government shuts down Anthropic models
The Commerce Department issued an unprecedented export control directive forcing Anthropic to globally suspend Claude Fable 5 and Mythos 5 within hours of launch, citing a jailbreak vulnerability as a national security threat — a move Anthropic publicly disputed as disproportionate.
#1 · ai · scored 9/10
Critical RCE and 0-day in enterprise software
A CVSS 9.8 unauthenticated RCE in Splunk Enterprise (below 10.2.4/10.0.7), an actively exploited 0-day in Oracle PeopleSoft affecting hundreds of organizations, and 21 zero-days in the ubiquitous FFmpeg library collectively signal a severe week for widely-deployed enterprise and open-source software.
#2 · security · scored 9/10
Critical Splunk RCE vulnerability
A CVSS 9.8 unauthenticated RCE vulnerability (CVE-2026-20253) in Splunk Enterprise versions below 10.2.4 and 10.0.7 requires immediate patching across all affected observability deployments.
#3 · observability · scored 9/10
Arch Linux supply-chain compromise
Over 400 AUR packages were backdoored with a Rust-based credential stealer and eBPF rootkit, with Arch Linux reporting the incident ultimately touched over 1,500 packages before being contained — a significant supply-chain attack on a widely-used rolling-release Linux distribution.
#4 · security · scored 8/10
China-linked threat actors target core infrastructure
The Velvet Ant group backdoored PAM and OpenSSH authentication components for nearly a decade, evading detection by hiding inside trusted Linux login systems — a sophisticated persistence technique targeting foundational infrastructure.
#5 · security · scored 8/10
Linux authentication supply-chain attacks
A China-linked group (Velvet Ant) backdoored PAM and OpenSSH for nearly a decade, while Arch Linux simultaneously disclosed a supply-chain compromise affecting over 1,500 packages — together signaling sustained, sophisticated targeting of Linux authentication and package infrastructure.
#6 · infrastructure · scored 8/10
AUR supply-chain attack
Over 400 Arch User Repository packages were compromised with malicious build scripts delivering a Rust-based credential stealer and eBPF rootkit, exposing a major supply-chain vulnerability in community-maintained Linux repositories.
#7 · programming · scored 8/10
AI regulatory pressure mounts
The U.S. government suspended Anthropic's Claude Fable 5 and Mythos 5 for foreign nationals on national security grounds, multiple state AGs opened investigations into OpenAI's data practices, and a German court ruled companies liable for false AI-generated statements — signaling a rapid escalation of legal and regulatory pressure on AI across jurisdictions.
#8 · industry · scored 8/10
Google sues AI-enabled fraud network
Google filed a landmark lawsuit against a Chinese cybercrime group called 'Outsider Enterprise' that weaponized Gemini AI to deliver 2.5 million phishing texts to Americans, marking the first major legal confrontation over malicious use of a foundation model.
#9 · ai · scored 7/10
AI liability and browser agent standards
A German court ruling holding companies liable for false AI-generated statements and Google's WebMCP origin trial in Chrome 149 — which standardizes how AI agents interact with web apps — together signal a maturing legal and technical framework for AI deployment.
#10 · ai · scored 7/10