The 10 biggest things in tech, Tue, Jul 7
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Linux KVM Januscape hypervisor escape
CVE-2026-53359 'Januscape', a 16-year-old use-after-free flaw in Linux KVM's shadow MMU, allows guest VMs to escape to the host kernel on both Intel and AMD x86 systems, threatening virtualized infrastructure across major cloud providers and enterprises.
#1 · security · scored 8/10
EU Chat Control encryption regulation advances
The EU Parliament advanced Chat Control legislation mandating client-side message scanning, a sweeping privacy and encryption policy shift that would require tech companies serving Europe to surveil user communications at the device level.
#2 · security · scored 8/10
Critical KVM hypervisor escape CVE
CVE-2026-53359 'Januscape', a 16-year-old use-after-free bug in Linux KVM's shadow MMU, allows guest VMs to escape to the host kernel on both Intel and AMD x86 systems, threatening virtualized infrastructure across major cloud providers and enterprises.
#3 · infrastructure · scored 8/10
EU surveillance regulation advances
The EU Parliament advanced Chat Control legislation mandating client-side message scanning, while campaigners escalated pressure after Pegasus spyware infected an MEP investigating surveillance — together marking a pivotal week for European digital rights and encryption policy.
#4 · industry · scored 8/10
Claude Cowork multi-platform expansion
Anthropic shipped Claude Cowork across web, mobile, and cloud — enabling persistent background task execution without a laptop open — with data showing 90% of sessions are non-coding use cases, signaling agents are moving beyond developer tooling.
#5 · ai · scored 7/10
AI-driven ransomware threat overhyped
Reports of JadePuffer as the 'first fully AI-driven ransomware' are undercut by evidence that human operators still handled victim selection, infrastructure, and credentials — revealing a gap between media framing and the actual autonomy of AI-assisted attacks.
#6 · ai · scored 7/10
AI-driven attacks and autonomous threat hype
The JadePuffer ransomware campaign claimed as the first fully AI-driven attack was tempered by reporting that human operators still controlled victim selection and infrastructure, while a GitHub agentic workflow flaw and a DigiCert survey showing 78% of enterprises hit by AI-related incidents underscore that AI is materially reshaping the attack surface even if full autonomy remains overstated.
#7 · security · scored 7/10
Enterprise platform credential and access attacks
Multiple active campaigns are targeting enterprise platforms — the DEBULL phishing operation abuses Microsoft device-code flow against M365, Unit 42 documents EtherRAT delivery via fake Teams helpdesk calls, and China-aligned actors exploit patched Roundcube CVEs (CVSS 9.3) to steal credentials from U.S. and Canadian universities.
#8 · security · scored 7/10
Critical patches: BeyondTrust, Writer AI, OpenSSH, Tenda
A cluster of high-severity patches landed this week: BeyondTrust shipped fixes for two pre-auth RCE flaws (CVE-2026-40138, CVSS 9.2) in its PAM products, the Writer AI platform patched a cross-tenant session isolation exploit, OpenSSH 10.4 addressed security issues in the widely-deployed SSH daemon, and CERT/CC warned of an authentication backdoor (CVE-2026-11405) in Tenda router firmware.
#9 · security · scored 7/10
Developer supply chain under sustained attack
PyPI's Trusted Publishing mechanism was called out as providing false security assurance, the Cordyceps CI/CD supply-chain attack pattern was documented by Novee, and analysis of AI code generation as a new supply-chain vector collectively signal that attackers are systematically targeting build and distribution infrastructure.
#10 · security · scored 7/10