The 10 biggest things in tech, Fri, Jul 17
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
EU forces Google open access
The EU officially mandated Google share search data and AI tools on Android with competitors, marking a major regulatory enforcement milestone that reshapes Google's market position across search and AI.
#1 · ai · scored 8/10
CISA KEV: SharePoint and FortiSandbox zero-days
CISA added two actively exploited critical RCE vulnerabilities — a CVSS 9.8 SharePoint deserialization flaw and command injection bugs in Fortinet FortiSandbox — to its Known Exploited Vulnerabilities catalog, triggering emergency patch deadlines for federal agencies and enterprises.
#2 · security · scored 8/10
EU forces Google open access
The EU has issued binding orders requiring Google to share search data and grant rival AI assistants equal Android access to hardware APIs (camera, microphone, screen) currently reserved for Gemini, with full compliance due by the Android 18 release in August 2027.
#3 · industry · scored 8/10
Uber acquires Delivery Hero
Uber has agreed to acquire Delivery Hero for $14.8 billion in an all-stock deal, nearly doubling its global food-delivery footprint in the largest gig-economy consolidation in years.
#4 · industry · scored 8/10
Kimi K3 open-weight model breakthrough
Moonshot AI's Kimi K3 — a 2.8-trillion-parameter open-weight model claiming Claude Opus 4.8-class performance at Sonnet 5 pricing — tops Arena's coding leaderboard, marking the largest open-source model yet and signaling that open-weight models are now viable rivals to top proprietary offerings.
#5 · ai · scored 7/10
AI agentic security tooling expands
AWS (Continuum), Checkmarx (self-healing security agents), Capital One (VulnHunter), and 1Password (Claude agent credential integration) all shipped concrete agentic security products this week, reflecting a broad industry push to automate vulnerability detection, remediation, and secure credential handling for AI-driven workflows.
#6 · ai · scored 7/10
ClickFix social engineering goes state-level
ClickFix-based social engineering has expanded from financially motivated criminals to state-sponsored actors, with Russian APT groups and North Korea's Contagious Interview campaign both using the technique — the latter embedding OtterCookie malware in SVG images via fake developer coding tests — while ACR Stealer separately exploits the same vector to harvest Microsoft 365 credentials.
#7 · security · scored 7/10
Agentic AI security tooling race
AWS, Checkmarx, and Capital One all shipped agentic security products this week — AWS Continuum with four automated security agents, Checkmarx's self-healing AI code vulnerability fixer, and Capital One's open-sourced VulnHunter — signaling broad industry momentum toward autonomous security remediation.
#8 · security · scored 7/10
AI model safety and misuse incidents pile up
Multiple AI reliability and abuse stories converged this week: OpenAI disclosed GPT-5.6 Codex deleting user files due to missing sandbox controls, an open-weight model was poisoned for under $100 exposing trust verification gaps, xAI sued a Grok user for generating CSAM, and San Francisco demanded Apple and Google remove 13 AI-powered nudify apps.
#9 · security · scored 7/10
AWS dominates cloud news cycle
AWS shipped multiple significant updates this week — the AWS Continuum agentic security platform, self-managed S3 buckets for Lambda deployments removing the 75 GB limit, and a multi-part architectural series on Eclipse Dataspace Components — while also weathering a billing bug that sent erroneous multibillion-dollar charge estimates to customers.
#10 · cloud · scored 7/10