The 10 biggest things in tech, Tue, Sep 15
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Cisco email gateway critical CVE exploited
CVE-2026-76461 (CVSS 9.8) in Cisco Secure Email Gateway AsyncOS is actively exploited in the wild, allowing root command execution via a single malicious email with no workarounds available, forcing immediate patching to AsyncOS 15.5.5, 16.0.4, or 16.5.0.
#1 · security · scored 9/10
Massive US driver's license breach
The Nexus dark web service breached 153 million US and Canadian driver's licenses and 3 million travel documents from identity verification company IDScan, with continuous data exfiltration over a year and government officials' credentials compromised, posing severe national security and identity theft risks.
#2 · security · scored 9/10
Trump EPA guts power plant climate rules
The Trump EPA overturned Biden's 2024 Carbon Pollution Standards for power plants—the second-largest US greenhouse gas source—arguing the rules exceed Clean Air Act authority and controversially claiming power plant emissions have no material climate impact.
#3 · industry · scored 9/10
Chinese hackers exploit Chrome-Windows zero-day chain
Chinese threat actor UTA0560 exploited a three-CVE Chrome-Windows zero-day chain delivered via reflective XSS to deploy GRIMWEDGE, a JavaScript backdoor, while Microsoft's September 2026 Patch Tuesday addressed 950+ vulnerabilities (2,750 YTD) including two actively exploited zero-days for Windows privilege escalation—a record pace driven by AI-assisted vulnerability discovery.
#4 · security · scored 8/10
Iranian state malware targets dissidents globally
US, UK, and Netherlands intelligence jointly disclosed HEAVYGRAM/CHOSEN BRICK, Iran MOIS-attributed Telegram-controlled Windows spyware active since 2023 that exfiltrates emails, screenshots, and audio from dissidents and journalists, delivered via trojanized apps like Norton and KeePass.
#5 · security · scored 8/10
Google Gemini 3.8 Live voice agents ship
Google DeepMind released Gemini 3.8 Live and 3.8 Live Extended Thinking, production-ready voice agent models ranking #1 on Artificial Analysis' Speech-to-Speech Quality Index (82.6) with 68.6% on τ-Voice agentic benchmarks, supporting 97 languages with real-time visual grounding and competitive enterprise pricing.
#6 · ai · scored 8/10
Google Cloud agent infrastructure platform launches
Google Cloud shipped Agent Substrate on GKE (10x sandbox density, sub-500ms resume, zero-trust isolation) and Filestore agent volumes (millisecond-provisioned persistent workspaces), forming a coordinated production infrastructure stack for running millions of concurrent AI agents.
#7 · platform · scored 8/10
Java 27 ships post-quantum security
Oracle released Java 27 with post-quantum hybrid key exchange for TLS 1.3 via ML-KEM (JEP 527), G1 as default GC, structured concurrency, AI integration APIs, and a new monthly critical security patch cadence, with quantum cryptography backported to JDK 8–25 by late 2027.
#8 · backend · scored 8/10
Salesforce-Nvidia open-weight enterprise reasoning model
Salesforce and Nvidia jointly released Koa, an open-weight reasoning model built on Nemotron for enterprise sales and support tasks, marking Salesforce's first reasoning model and offering a sovereign, lower-cost alternative to closed frontier models like Claude and ChatGPT.
#9 · ai · scored 8/10
Marimo RCE exploited in eight-second pivot
Sysdig documented a skilled human attacker exploiting CVE-2026-39987 (Marimo RCE, CVSS 9.3) to pivot from a Marimo notebook to an SSH bastion in eight seconds using custom Python tools, demonstrating that expert operators can move at machine speed without AI assistance and evade defenses designed for agentic threats.
#10 · security · scored 8/10