The 10 biggest things in tech, Tue, Sep 1

The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.

  1. Critical CVEs actively exploited in dev tools

    Threat actors began mass-exploiting three critical flaws within days of disclosure: CVE-2026-82329 (JFrog Artifactory, CVSS 9.8) enabling admin token minting, CVE-2026-0768 (Langflow RCE, CVSS 9.8), and CVE-2026-66066 (Rails, CVSS 9.5), with 360+ detected exploitation events as of late August.

    #1 · security · scored 9/10

  2. OpenAI Astra reaches critical cyber threshold

    OpenAI announced its Astra model autonomously discovers and exploits zero-day vulnerabilities, scoring perfectly on ExploitBench, prompting the company to implement safeguards, a misalignment monitor, and a restricted Daybreak Blue partner program before broad release — while simultaneously warning that AI-driven cyberattack swarms are months away.

    #2 · ai · scored 9/10

  3. Anthropic Claude Fable 5.1 release

    Anthropic released Claude Fable 5.1 and Mythos 5.1 with significantly improved benchmark performance (52.6% Terminal-Bench-Science vs. 24.7%), 75% cheaper cache reads, reduced false-positive refusals, zero data retention options, and restricted partner access for cybersecurity and biology research.

    #3 · ai · scored 8/10

  4. iOS supply-chain attack steals crypto seeds

    Thirteen malicious Packagist Composer packages exploit unpatched iOS WebKit CVEs (CVE-2025-31277, CVE-2025-43529) with a kernel escape to exfiltrate keychain data, Wi-Fi passwords, SMS, photos, and cryptocurrency wallet seeds from Vietnamese streaming site visitors.

    #4 · security · scored 8/10

  5. FTC sues Amazon for $20B ad fraud

    The FTC and 22 states sued Amazon alleging it systematically rigged billions of ad auctions for Sponsored Products, Brands, and Display ads from 2019 to present, overcharging ~1.2 million advertisers and generating $20 billion in illegal revenue based on internal documents.

    #5 · security · scored 8/10

  6. AWS acquires DuckLabs, launches Graviton5

    AWS made two major platform moves: acquiring DuckLabs (the company behind open-source DuckDB) to serve as 'connective tissue' across its data estate, and generally releasing EC2 R9g/R9gd instances on Graviton5 with 25% better compute performance, 5x larger L3 cache, and DDR5 8800 MT/s memory.

    #6 · platform · scored 8/10

  7. Microsoft-AWS multicloud interconnect bridge

    Microsoft and AWS jointly launched multicloud interconnect services combining Azure Multicloud Interconnect with AWS Interconnect, enabling private 100 Gbps links between platforms, reversing prior claims that significant multicloud barriers did not exist.

    #7 · platform · scored 8/10

  8. Google foundation models for time series and tabular data

    Google launched two zero-shot foundation models: TimesFM-3 (330M parameters, trained on 1 trillion time points) for multivariate time-series forecasting outperforming Amazon and Salesforce competitors, and TabFM in BigQuery for regression and classification on tabular data via SQL, both available for limited or enterprise use.

    #8 · ai · scored 7/10

  9. AI agent governance and IAM go mainstream

    HashiCorp shipped Vault 2.1 with generally available agentic IAM and an Agent Registry UI, HCP Terraform positioned itself as a policy-as-code governance plane for AI-driven infrastructure, and AIR raised $50M from Sequoia and Greenoaks to vet AI agent skills, MCP servers, and plugins for enterprise deployment.

    #9 · security · scored 7/10

  10. Agentic cybersecurity tools proliferate

    NVIDIA and CrowdStrike launched SafeMind, an agentic cybersecurity system built on Nemotron models with a continuous offensive-defensive coevolution loop in the Falcon platform, while ClickHouse acquired RunReveal to expand agentic threat investigation capabilities.

    #10 · ai · scored 7/10