The 10 biggest things in tech, Wed, Aug 12
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Encrypted reasoning blocks vulnerability
Researchers disclosed that Anthropic, OpenAI, and Google's reasoning APIs leaked encrypted chain-of-thought blocks reusable across sessions, enabling jailbreaks of weaker model siblings and extraction of 704 privacy artifacts including 62 API keys and 33 passwords from public Claude Code sessions; all three vendors patched after responsible disclosure.
#1 · ai · scored 9/10
Patch Tuesday mass vulnerability wave
Microsoft's August Patch Tuesday addressed 398–421 vulnerabilities including CVE-2026-68820 (afd.sys privilege escalation actively exploited by Lazarus), four CVSS 9.8 unauthenticated RCEs, and a Windows Defender zero-day (ShieldBreak/CVE-2026-50656) with public PoC and no patch, while Adobe shipped three CVSS 10.0 fixes for ColdFusion and Campaign Classic, SAP patched a CVSS 10.0 arbitrary code execution in Commerce Cloud, and VMware vCenter CVE-2026-59310 (CVSS 9.8) saw active exploitation across 361 IPs in 47 countries within five days of patch release.
#2 · security · scored 9/10
AI model supply chain under siege
JFrog documented 100+ backdoored Hugging Face models exploiting pickle deserialization (with three zero-days in detection tool PickleScan), a malicious LiteLLM PyPI release spent 40 minutes live yet harvested credentials from 2,100+ organizations including NVIDIA, Cisco, and FedEx across 434,000 CI/CD pipelines, and a malicious MCP server ('productivity-suite') used runtime-gated metadata poisoning to steal SSH keys, AWS credentials, and Kubernetes configs — collectively showing AI infrastructure supply chains are now a primary attack surface.
#3 · security · scored 9/10
AI model supply chain under fire
JFrog documented 100+ backdoored models on Hugging Face exploiting pickle deserialization with three zero-days in PickleScan, while separate research revealed mass spoofing of AI bot identities (ClaudeBot, etc.) across 5,000+ websites, together painting a picture of systemic security failures across the AI model distribution and agent ecosystem.
#4 · ai · scored 8/10
Gemini hits 1 billion users
Google confirmed Gemini reached 1 billion monthly active users — its fastest-growing product ever, matching ChatGPT's June 2024 milestone — with 150 million daily images generated, 63% voice adoption, and simultaneous launches of Pixel 11 and Pixel Watch 5 embedding Gemini agentic features including ASL transcription and ride-booking automation.
#5 · ai · scored 8/10
Frontier model and platform launches
A wave of significant model and platform releases hit simultaneously: Alibaba's 2.4T-parameter Qwen3.8, NVIDIA's Nemotron 3.5 Lightning with NeMo Switchyard routing, Liquid AI's LFM2.5-VL-3B vision model, Meta's 30B open-weight Muse Glimmer, DeepSeek V4 Pro with OpenAI SDK support, and Modular's Mojo 1.0 GPU-agnostic AI language, collectively advancing the frontier across open and proprietary stacks.
#6 · ai · scored 8/10
AI startup funding surge
River AI raised $1.1 billion in seed/Series A backed by Nvidia and AMD, Lovable confirmed a $13.3 billion valuation on $400 million Series C, and Blacksmith hit a $550 million valuation on $45 million Series B — three deals in one week illustrating continued aggressive capital deployment into AI infrastructure and coding tooling.
#7 · ai · scored 8/10
China blocks Meta–Manus AI deal
Beijing regulators forced Meta to unwind its ~$2 billion acquisition of Chinese AI agent startup Manus and delete all user data created after December 2025, marking a concrete example of geopolitical risk forcing divestiture in AI vendor consolidation.
#8 · ai · scored 8/10
SharePoint critical RCE vulnerability
Rapid7 disclosed a chained CVE pair in SharePoint Server on-premises — a CVSS 9.1 JWT validation bypass enabling unauthenticated user impersonation (CVE-2026-55040) combined with a CVSS 8.1 RCE as service account (CVE-2026-63520) — affecting SharePoint 2016, 2019, and Subscription Edition.
#9 · backend · scored 8/10
Mojo 1.0 production release
Modular's Mojo programming language reached 1.0 as a stable, GPU-agnostic alternative to CUDA for AI workloads, developed by LLVM creator Chris Lattner, with community contributions of 1,100+ PRs and a commitment to open-source the compiler following Qualcomm's acquisition.
#10 · backend · scored 8/10