The 10 biggest things in tech, Thu, Aug 20
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Rust supply-chain attack via typosquat
The arrayref 0.3.10 Rust crate was compromised via a typosquatted proc-macro1 dependency that downloaded and executed a remote binary during compilation, with the attack window lasting 86 minutes before removal from crates.io — the latest in a string of developer supply-chain attacks including slopsquatting of AI-hallucinated package names and a phishing campaign distributing malicious TypeScript coding challenges via Bitbucket.
#1 · security · scored 9/10
Go 1.27 ships generics leap
Go 1.27 released with generic methods on individual receivers (resolving a five-year gap since Go 1.18), enhanced struct literals, generalized function type inference, 30% reduction in small-object allocation costs, and a new encoding/json/v2 with stricter defaults.
#2 · backend · scored 8/10
Stripe acquires OpenRouter for $7.5B
Stripe acquired AI model marketplace OpenRouter for $7.5 billion — nearly 6x its May valuation — integrating routing across 400+ AI models and 10M+ developers into Stripe's payments and developer ecosystem, with 88% of Forbes AI 50 companies already on Stripe.
#3 · ai · scored 8/10
AI-assisted attacks on critical infrastructure
Five U.S. federal agencies (CISA, FBI, NSA) and Cisco Talos warned of Iranian-linked and Chinese threat actors (UAT-10147) using AI-generated exploitation scripts against Siemens S7 PLCs at water, energy, and manufacturing facilities, with UAT-10147 also deploying a cross-platform SPECTRE implant with BYOVD EDR evasion and AI-assisted malware development.
#4 · security · scored 8/10
Bun 1.4 major runtime overhaul
Bun 1.4 rewrites the runtime from Zig to Rust, fixes 2,900+ issues, reduces idle CPU by 5x and memory by 35%, adds the largest Node.js test suite jump since 1.0, and introduces Bun.Image, Bun.WebView, Bun.markdown, Bun.cron(), and parallel test/run modes.
#5 · backend · scored 8/10
CDN HTTP/3 amplification vulnerability
Researchers disclosed CDN Tsunami, a chain of HTTP/3 translation flaws in Alibaba, Baidu, Cloudflare, AWS CloudFront, Fastly, and Tencent that amplifies DoS attacks up to 350x against origin servers, with all six CDNs susceptible to the bandwidth variant and exploits requiring no configuration changes.
#6 · security · scored 8/10
Critical CMS and enterprise CVEs pile up
A wave of critical vulnerabilities hit widely-deployed software: Elementor Pro CVSS 9.0 unauthenticated RCE via file upload (CVE-2026-32475), Citrix NetScaler ADC/Gateway authentication bypass CVSS 9.3 and memory overflow CVSS 8.8 (CVE-2026-19489/19490), Zimbra RCE under active exploitation (CVE-2026-73570 CVSS 8.9), and isolated-vm sandbox escape with 1M weekly npm downloads (GHSA-864f-rcv7-6rh4).
#7 · security · scored 8/10
NASA AIT-GUI spacecraft command vulnerability
NASA's AIT-GUI spacecraft command console (versions ≤2.5.1) contains a CVSS 9.4 vulnerability chain allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed POST endpoints with no authentication or CSRF protection, patched in 2.5.2.
#8 · security · scored 8/10
Grok cryptographic prompt injection attack
Adversa AI disclosed a Cryptographic Context Injection attack against xAI's Grok that encrypts malicious instructions in AES-256-GCM on web pages — bypassing content classifiers that cannot decrypt ciphertext while the model itself can — enabling exfiltration of user names, locations, subscription tiers, and chat history at 40% success rate, with no patch deployed since June disclosure.
#9 · security · scored 8/10
Linux kernel 7.2 ships busy cycle
Linux kernel 7.2 released in one of the busiest development cycles ever, featuring cache-aware scheduling, MGLRU improvements, sched_ext sub-schedulers, automatic multi-size transparent hugepages, and Raspberry Pi 4/5 GPU runtime power management.
#10 · platform · scored 8/10