The 10 biggest things in tech, Tue, Aug 18
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
GitHub outage strains AI-era infrastructure
GitHub suffered a major multi-hour outage Monday affecting 180 million users with error rates hitting 50% for repository downloads, exposing that Microsoft needs 30x capacity expansion to handle AI-driven traffic growth that is degrading Copilot, Actions, and enterprise auth.
#1 · platform · scored 9/10
Critical RCE vulnerabilities under active exploit
CISA issued a 3-day remediation deadline for a critical DNS-rebinding RCE in Ray 2.52.0 and earlier (CVE-2025-62593, CVSS 9.4), exploitable via Firefox/Safari and affecting Amazon, Apple, and OpenAI workloads; meanwhile, a CVSS 9.8 arbitrary file upload RCE in Forminator Forms (600K+ WordPress installs) was patched in version 1.56.2, and GitLab shipped emergency updates across four branches for a CVSS 9.4 GraphQL flaw (CVE-2026-19478) allowing unauthenticated project and data modification.
#2 · security · scored 9/10
Stripe acquires OpenRouter for $7B
Stripe acquired AI model-routing gateway OpenRouter for at least $7 billion — a 5x valuation jump in under 90 days — cementing Stripe's pivot toward AI infrastructure by controlling the layer that meters and routes 250 trillion tokens per month across 8 million developers.
#3 · industry · scored 9/10
GitHub major outage hits 180M users
GitHub suffered a multi-hour outage Monday affecting 180 million users, with error rates hitting 50% for repository downloads and enterprise auth, also degrading Copilot and Actions during peak sprint-start hours.
#4 · industry · scored 9/10
Stripe acquires OpenRouter for $7B
Stripe finalized the acquisition of AI model gateway OpenRouter for at least $7 billion — a 5x valuation jump in under a year — capturing OpenRouter's 250 trillion tokens/month routing layer across 8 million developers and positioning Stripe as the financial and infrastructure backbone of AI token commerce.
#5 · ai · scored 8/10
Microsoft Copilot prompt-injection vulnerabilities
Varonis Threat Labs disclosed two separate Microsoft 365 Copilot vulnerabilities — one enabling data exfiltration by bypassing safety guardrails, another ('CoSnitch') revealing an undocumented `autorun=1` parameter that triggers prompt auto-execution without user consent — with Microsoft planning a CVE and patch.
#6 · ai · scored 8/10
EU AI Act watermarking triggers circumvention race
Major AI providers (Anthropic, Google, OpenAI, Meta) deployed statistical watermarking and C2PA metadata across inference pipelines to comply with EU AI Act Article 50 as of August 2, 2026, but open-source watermark-removal tools emerged immediately, while MIT research showed attribution decay makes large-model outputs increasingly hard to trace — collectively undermining the regulatory framework's enforceability.
#7 · ai · scored 8/10
AI agent security vulnerabilities multiply
Multiple research disclosures this week — self-propagating 'mind virus' payloads spreading between agents via persistent memory files (55% infection rate), a Cursor CVE allowing shell built-ins to bypass command allowlists, and a post-mortem on the OpenAI/Hugging Face breach where an agent executed 17,600 undetected actions over 4.5 days — collectively show that AI agent security requires systems-level detection, not perimeter controls.
#8 · ai · scored 8/10
Apple EU App Store terms overhaul
Apple announced unified EU business terms effective October 1, 2026, replacing the Core Technology Fee with a 5% out-of-app commission and 26% App Store cut while allowing alternative payments alongside In-App Purchase, resolving the standoff with the European Commission.
#9 · platform · scored 8/10
Vercel's $1M bug bounty launch
Vercel launched a $1 million two-week public bug bounty on HackerOne offering up to $50,000 per tenant-isolation vulnerability in its Firecracker microVM-based Vercel Sandbox, signaling high-stakes confidence in its multi-tenant architecture.
#10 · platform · scored 8/10