The 10 biggest things in tech, Fri, Jun 26
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Amazon Q critical security flaw
A critical vulnerability in Amazon Q Developer (CVE-2026-12957, CVSS 8.5) allowed malicious Git repositories to execute arbitrary commands and exfiltrate AWS cloud credentials via Model Context Protocol configuration, now patched.
#1 · ai · scored 8/10
npm/GitHub supply chain attacks
Microsoft's disclosure of the Miasma campaign poisoning 20+ npm packages (LeoPlatform, RStreams) and the broader Mini Shai-Hulud/Miasma/Hades malware family campaign spanning npm, GitHub Actions, and Go ecosystem reveal an active, evolving multi-vector supply chain attack targeting developer credentials.
#2 · security · scored 8/10
Linux kernel privilege escalation flaws
Two high-severity Linux kernel local privilege escalation CVEs — DirtyClone (CVE-2026-43503, CVSS 8.8) in cloned network packet handling and 'pedit COW' (CVE-2026-46331) in the traffic-control subsystem — both have working public exploits available, demanding immediate patching.
#3 · security · scored 8/10
AI coding assistant security flaws
Amazon Q Developer's CVE-2026-12957 (CVSS 8.5) allowed malicious Git repositories to execute arbitrary commands and exfiltrate cloud credentials via MCP configuration, exposing a critical attack surface in AI-assisted development tools now used at scale.
#4 · security · scored 8/10
Industry hardens OSS against AI threats
The Linux Foundation launched Akrites, backed by AWS, Google, Microsoft, and Anthropic, to systematically harden critical open-source projects against AI-accelerated vulnerability discovery and supply chain attacks.
#5 · security · scored 8/10
Linux kernel privilege escalation flaws
Two high-severity Linux kernel CVEs — DirtyClone (CVE-2026-43503, CVSS 8.8) in network packet memory and pedit COW (CVE-2026-46331) in the traffic-control subsystem — both shipped with working public exploits on day one, putting Linux infrastructure operators under immediate patching pressure.
#6 · infrastructure · scored 8/10
AI governance and regulation tightens
Government and regulatory pressure on AI deployments intensified across multiple fronts: the Trump administration intervened in OpenAI's GPT-5.6 rollout, a German court established corporate liability for Google's AI Overviews, and Italy's regulator opened an investigation into Microsoft 365 Copilot's pricing practices.
#7 · industry · scored 8/10
Open-source AI security initiative launches
The Linux Foundation launched Akrites, backed by AWS, Google, Microsoft, and Anthropic, as a coordinated industry initiative to harden critical open-source software against AI-enabled vulnerability discovery.
#8 · industry · scored 8/10
AI agent security and governance gaps
A cluster of disclosures and analyses — Anthropic's accusation of a 25,000-account Claude model-cloning operation by Alibaba, identity/authentication gaps as agents inherit permissions autonomously, and inadequate enterprise governance frameworks — paint a picture of AI agent deployments racing ahead of security and oversight infrastructure.
#9 · ai · scored 7/10
AI agent platforms and tooling proliferate
Vercel shipped Eve (open-source agent deployment framework), Dapr 1.18 added cryptographic execution guarantees for agents, AWS/Microsoft/Google/Anthropic independently converged on session-based compute models for agentic workloads, and Patronus AI raised $50M for agent stress-testing infrastructure — marking a broad industry push to productionize AI agents.
#10 · ai · scored 7/10