The 10 biggest things in tech, Sun, Aug 2
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Coldcard firmware RNG heist
A 2021 firmware bug in Coldcard Bitcoin wallets silently used a weak software PRNG instead of the hardware RNG for seed generation, and on July 30, 2026 attackers exploited this to drain 1,082.65 BTC (~$70.2M) from 1,196 addresses in 41 minutes — with a postmortem tracing the root cause to commits with catastrophically low code-review ratios.
#1 · security · scored 9/10
EU AI Act takes effect
The EU AI Act becomes enforceable on August 2, 2026, mandating transparency labeling for AI use in ads, chatbots, and business processes across all firms operating in the EU market, with fines up to €15M or 3% of global revenue.
#2 · security · scored 9/10
EU AI Act compliance deadline looms
The EU AI Act takes full effect August 2, 2026, mandating transparency labeling across all AI use in ads, chatbots, and business processes for every firm operating in the EU, with fines up to €15M or 3% of global revenue.
#3 · ai · scored 8/10
AI cracks frontier mathematics
OpenAI's internal Astra model solved ten decades-old open mathematics problems—spending ~$2,000 per proof at GPT-5.6 rates and publishing Lean 4 formalizations—sparking debate among mathematicians about AI's looming role in research discovery.
#4 · ai · scored 8/10
Critical macOS Screen Sharing RCE
A pre-authentication RCE in macOS's screensharingd daemon (versions ≤26.5) allows unauthenticated attackers to execute code as root via an SRP frame-length bug; Apple patched it in macOS 26.6 on July 27, 2026.
#5 · security · scored 8/10
OT/ICS infrastructure exposed to attackers
CISA warned on July 30 that threat actors are actively targeting internet-exposed PLCs in water utilities to trigger boil-water notices, with Censys finding over 10,000 Rockwell, Siemens, and Schneider Electric industrial hosts publicly reachable.
#6 · security · scored 8/10
HuggingFace credential exposure crisis
A scan of 7.6 petabytes across 187M HuggingFace files uncovered 221,303 live credentials including GitHub repo-write tokens, Docker Hub tokens, and a single secret exposing 393 GB of PII affecting roughly 3.7% of the global population.
#7 · security · scored 8/10
Distributed consensus and data sync
Cloudflare shipped Meerkat, the first production deployment of the QuePaxa leaderless consensus algorithm at global scale, while Syncular launched an offline-first SQL sync framework with TypeScript/Rust cores and E2EE — both tackling hard distributed-state problems in backend infrastructure.
#8 · backend · scored 7/10
Cloudflare builds agent-native infrastructure
Cloudflare shipped two distinct infrastructure advances this week — Meerkat, the first production deployment of the QuePaxa leaderless consensus algorithm for globally consistent coordination, and 'Agents Week,' framing a new class of agent-native cloud primitives designed around AI agent access patterns rather than human ones.
#9 · platform · scored 7/10
Robotaxi regulation tensions
NHTSA granted Zoox a safety-standard exemption to launch paid robotaxi rides in Las Vegas, even as Waymo incidents prompt state officials and Congress to push for stricter AV oversight — exposing a widening gap between federal permissiveness and local safety concerns.
#10 · industry · scored 7/10