The 10 biggest things in tech, Wed, Jul 15

The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.

  1. Microsoft Patch Tuesday record surge

    Microsoft's July Patch Tuesday set a record with 570–622 CVEs — nearly triple the previous month — including two actively exploited zero-days and 61 critical vulnerabilities, with AI-assisted discovery credited for the unprecedented volume; CISA also warned of three additional actively exploited SharePoint flaws and a proof-of-concept exploit was published hours after the release.

    #1 · security · scored 9/10

  2. Stripe-PayPal mega acquisition bid

    Stripe and Advent International jointly bid $53.4 billion to acquire PayPal, backed by $50 billion in committed financing — a deal that would consolidate two of the most critical players in global payment infrastructure under joint fintech and private equity ownership.

    #2 · industry · scored 9/10

  3. AI coding agents go mainstream

    OpenAI unified GPT-5.6 and Codex into ChatGPT desktop with 8M users, AWS and Anthropic shipped Claude Apps Gateway for enterprise Codex/Claude Desktop management, Atlassian wired Claude Code and Cursor directly into Jira, Anaconda acquired model-agnostic coding agent Kilo, and Indian AI coding unicorn Emergent hit $130M ARR — collectively marking the week agentic coding moved from experiment to enterprise infrastructure.

    #3 · ai · scored 8/10

  4. Microsoft Secure Boot broken for decade

    Unrevoked UEFI shims have silently bypassed Microsoft's Secure Boot mechanism for roughly ten years, exposing billions of Windows systems to a fundamental firmware-level security failure only recently discovered.

    #4 · security · scored 8/10

  5. SonicWall CVSS-10 zero-days exploited

    SonicWall disclosed two actively exploited zero-day vulnerabilities in SMA 1000 appliances, including CVE-2026-15409 rated CVSS 10.0, enabling unauthenticated remote code execution via SSRF and demanding immediate patching.

    #5 · security · scored 8/10

  6. SonicWall SMA zero-day exploited

    SonicWall disclosed two actively exploited zero-days in SMA 1000 series appliances, including a CVSS 10.0 unauthenticated RCE via SSRF (CVE-2026-15409), demanding immediate patching across affected enterprise deployments.

    #6 · infrastructure · scored 8/10

  7. Developer supply-chain attacks surge

    Four compromised @asyncapi npm packages delivered botnet malware to JavaScript developers, while a critical Cursor IDE vulnerability on Windows allows arbitrary code execution via malicious git.exe files — two distinct but concurrent attacks targeting developer toolchains.

    #7 · programming · scored 8/10

  8. AI regulation tightens globally

    Australia mandated concrete operational AI requirements including net energy-positive operation, New York imposed a moratorium on datacenters over 50 MW, and DeepMind's CEO called for a FINRA-style AI standards body — signaling a coordinated global wave of binding AI governance moving from proposal to enforcement.

    #8 · industry · scored 8/10

  9. Google Android antitrust forced open

    A court-ordered antitrust remedy forces Google to allow third-party app stores on Google Play, marking the most significant structural change to Android's app distribution ecosystem and setting a precedent for platform openness globally.

    #9 · industry · scored 8/10

  10. Apple AI expands globally

    Apple released iOS 27 public beta with a revamped AI-powered Siri and simultaneously launched Apple Intelligence in China via a regulatory-approved partnership with Alibaba's Qwen models, signaling Apple's dual strategy of domestic AI advancement and region-specific compliance.

    #10 · ai · scored 7/10