The 10 biggest things in tech, Wed, Jul 8
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
AI coding agents actively exploitable
Multiple researchers disclosed critical vulnerabilities in GitHub Copilot, Claude, and Gemini coding assistants this week — including prompt injection leaking private repositories ('GitLost'), jailbreaks via code editors bypassing chat-level safety filters, 'HalluSquatting' attacks serving botnet malware through hallucinated package names, and a 'GhostApproval' flaw in human-in-the-loop workflows — painting a picture of systemic security gaps in production AI dev tooling.
#1 · ai · scored 9/10
Agent infrastructure investment surge
Entire (founded by GitHub's former CEO Nat Friedman, $60M seed at $300M valuation) launched a distributed Git network for agent-scale development, AI chip maker SambaNova raised $1B at an $11B valuation, Prime Intellect closed a $130M Series A for decentralized agent training, and Vercel acquired Better Auth for agent identity — signaling a broad infrastructure buildout for the agentic development era.
#2 · ai · scored 8/10
AI coding agents security crisis
Multiple research teams this week demonstrated that GitHub Copilot, Claude, and Gemini can be compromised via prompt injection to leak private repositories, jailbroken through code editors to bypass safety refusals, and manipulated via 'HalluSquatting' to serve botnet malware through hallucinated package names — revealing a systemic security crisis in production AI development tooling.
#3 · security · scored 8/10
Linux and BSD privilege escalation flaws
A 15-year-old Linux kernel privilege escalation flaw (GhostLock, CVE-2026-43499) affecting all major distributions since 2011 was disclosed alongside a separate use-after-free root escalation bug (CVE-2026-57589) in OpenBSD through 7.9, putting essentially all major open-source OS deployments at risk from local attackers.
#4 · security · scored 8/10
Active CVE exploitation surge
CISA added four actively exploited CVEs to the KEV catalog — including a CVSS 10.0 Adobe ColdFusion flaw — while Ubiquiti patched a CVSS 10.0 privilege escalation across its UniFi product line, and Tenda firmware was found to contain a hidden authentication backdoor, signaling a broad wave of critical exploitation across enterprise and consumer networking software.
#5 · security · scored 8/10
Linux and OpenBSD privilege escalation CVEs
A 15-year-old Linux kernel flaw (CVE-2026-43499 'GhostLock') enabling any logged-in user to gain root has been disclosed alongside a separate use-after-free privilege escalation in OpenBSD through 7.9, with OpenBSD simultaneously shipping new anti-ROP mitigations — putting two major Unix-family OSes under security pressure simultaneously.
#6 · infrastructure · scored 8/10
TypeScript 7.0 native port ships
Microsoft released TypeScript 7.0, a native-ported rewrite delivering 10x performance gains while preserving JavaScript compatibility — a major milestone for the most widely-used typed JavaScript toolchain.
#7 · programming · scored 8/10
Enterprises cut AI costs at scale
Microsoft shifted spending away from third-party AI APIs toward its own models to reduce operational costs, while Coinbase deployed 1,200 AI agents and cut AI costs by 50% through multi-model infrastructure optimization — marking a concrete industry shift toward cost-efficient in-house agent deployments.
#8 · ai · scored 7/10
HalluSquatting botnet attack vector
Researchers demonstrated 'HalluSquatting', a novel attack class that registers fake package names AI coding assistants hallucinate and serves botnet malware, representing an actively exploitable vulnerability affecting GitHub Copilot, Claude, and Gemini.
#9 · ai · scored 7/10
Git commit verification undermined
Researchers demonstrated that signed Git commits can be rewritten with new hashes while preserving valid signatures — and separately that GitHub's 'Verified' commit badges do not guarantee content uniqueness — exposing a foundational flaw in the software supply-chain trust model relied upon by millions of developers.
#10 · security · scored 7/10