The 10 biggest things in tech, Sat, Jul 18
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
WordPress core RCE patched urgently
A critical unauthenticated remote code execution flaw (wp2shell) in WordPress 6.9 and 7.0 core prompted emergency patches 6.9.5 and 7.0.2 with forced auto-updates, while Cloudflare simultaneously deployed WAF rules to protect customers from this and a second high-severity WordPress vulnerability.
#1 · security · scored 9/10
Databricks $188B AI infrastructure bet
Databricks closed a funding round at a $188 billion valuation and published research validating open-weight models for enterprise code generation, cementing its position as a dominant AI infrastructure player.
#2 · ai · scored 8/10
Developer supply chains under attack
Two distinct campaigns hit developer toolchains this week: the ViteVenom campaign used seven malicious npm packages with a four-tier blockchain-based C2 across Tron and Ethereum to target Vite users, while the NadMesh Go botnet scanned exposed AI services (ComfyUI, Ollama, Langflow) to harvest AWS credentials and Kubernetes tokens from over 3,800 compromised keys.
#3 · security · scored 8/10
AI tools exposing cloud credentials
The NadMesh Go botnet, discovered in July, is actively scanning for unprotected AI services (ComfyUI, Ollama, Langflow, Gradio, n8n) to harvest AWS credentials and Kubernetes tokens, with its operator dashboard claiming 3,811 compromised AWS keys.
#4 · cloud · scored 8/10
AI tools harvested for cloud credentials
The NadMesh Go botnet is systematically scanning exposed AI services (ComfyUI, Ollama, n8n, Langflow, Gradio) to steal AWS credentials and Kubernetes tokens, with the operator dashboard claiming 3,811 compromised AWS keys — exploiting teams that deploy AI tooling without firewall protection.
#5 · infrastructure · scored 8/10
npm supply-chain attack on Vite
Checkmarx uncovered the ViteVenom campaign — seven malicious npm packages targeting Vite's ecosystem using a four-tier blockchain-based C2 infrastructure across Tron and Ethereum, extending the broader ChainVeil attack framework against developer supply chains.
#6 · programming · scored 8/10
OpenAI legal and IPO pressure
Apple filed a trade secrets lawsuit against OpenAI alleging systematic theft of proprietary information by over 400 former Apple employees, potentially disrupting OpenAI's reported IPO plans.
#7 · industry · scored 8/10
Databricks cements AI infrastructure lead
Databricks reached a $188 billion valuation in its latest funding round while publishing research validating cost savings from open-weight models, reinforcing its position as a core enterprise AI infrastructure provider.
#8 · industry · scored 8/10
AI drug discovery accelerates
Isomorphic Labs shipped a drug design engine extending beyond AlphaFold, while simultaneously announcing a joint AI bioresilience initiative with Google DeepMind, marking a significant week for AI-driven computational biology.
#9 · ai · scored 7/10
LLM model competition heats up
Anthropic responded to competitive pressure by permanently unlocking Claude in premium plans at 50% limits, while Moonshot's open-source Kimi K3 beat Claude on benchmarks and GPT-5.6 closed a 30-year-old optimization theory gap, reflecting a rapidly intensifying frontier model race.
#10 · ai · scored 7/10