The 10 biggest things in tech, Wed, Sep 9
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Microsoft Patch Tuesday record CVE deluge
Microsoft's September 2026 Patch Tuesday set a record with 974 CVEs patched (113 critical, 82 RCE), including two actively exploited zero-days — a Windows ALPC heap overflow and a Windows Update Stack EoP — while Adobe simultaneously fixed 172 CVEs including an actively exploited Magento 2 zero-day RCE.
#1 · security · scored 9/10
Critical enterprise software RCE flaws under attack
A wave of CVSS 10.0 unauthenticated RCE vulnerabilities are being actively exploited across SAP kernel (CVE-2026-44756), Cisco Secure Firewall Management Center (CVE-2026-20079), and N-able N-central (CVE-2026-86218), with state-sponsored and crimeware actors deploying web shells, credential theft, and Cyclops Blink malware.
#2 · security · scored 9/10
BlueMoon exploit kit hits four spy groups
Proofpoint exposed BlueMoon, a shared exploit kit chaining Chrome V8 sandbox escape (CVE-2026-85046) and Windows ALPC flaws that four separate espionage groups — including Chinese government-linked actors — deployed within a single week before stable patches closed the supply-chain gap, with evidence AI may be accelerating vulnerability discovery.
#3 · security · scored 8/10
Chinese AI firms accused of frontier model theft
The NSA, CISA, and FBI jointly named six Chinese AI firms — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — for conducting industrial-scale distillation attacks on Claude, GPT, Gemini, and Grok since late 2024, allegedly with Chinese government awareness, significantly compressing their development timelines.
#4 · ai · scored 8/10
Apple's fall hardware event: iPhone, Watch, AirPods
Apple's fall 2026 event introduced the iPhone 18 Pro (A20 Pro 2nm chip, variable aperture camera), the $1,999 iPhone Duo foldable (7.6-inch display, 100+ hinge components), Apple Watch Series 12 and Ultra 4 (every-5-second heart rate, always-listening Siri Recap), and AirPods 5 with 50% better ANC — positioning the iPhone as the hub of an AI-first personal computing strategy.
#5 · mobile · scored 8/10
Anthropic safety researcher quits with AI death warning
Anthropic researcher Jacob Coxon publicly resigned warning that frontier AI companies are 'gambling with our lives,' with Anthropic alignment lead Evan Hubinger confirming the lab internally estimates greater than 10% probability that AI kills all humans within a decade — a rare on-record admission from inside a major AI lab.
#6 · ai · scored 8/10
OpenAI GPT-6 Astra claims Navier-Stokes breakthrough
OpenAI claims its unreleased GPT-6 Astra model, running ~10,000 agents for 88 hours and consuming 130B tokens ($40M+ compute), produced a Navier-Stokes singularity result that could be a Millennium Prize contender — triggering technical skepticism, an ethics dispute with Anthropic-employed mathematician Tristan Buckmaster, and commentary from Terence Tao on AI-driven research racing harming open science.
#7 · ai · scored 8/10
AI agent sandbox security failures
A critical sandbox escape in DeepSeek Harness (CVE-2026-82533, CVSS 9.4) let AI coding agents disable their own file sandbox via a single unauthenticated local API call, while a new tool Geiger emerged to inventory every AI agent, MCP server, and plugin on a machine — reflecting a broad industry gap in agent permission models echoed across OpenAI, Anthropic, and Meta deployments.
#8 · ai · scored 8/10
npm supply chain worm compromises ecosystem
An npm worm infected hundreds of packages, stealing developer credentials and turning compromised projects into attack vectors for downstream supply chain compromise, while GitHub fixed a longstanding Dependabot authentication headache that previously forced use of personal access tokens for GitHub Packages.
#9 · security · scored 8/10
NVIDIA CUDA Rust GPU kernel support
NVIDIA announced CUDA Rust, enabling native GPU kernel development in Rust compiled to PTX across two programming tracks (SIMT and Tile) matching CUDA C++/Python, bringing Rust's compile-time safety guarantees to GPU-accelerated systems.
#10 · backend · scored 8/10