The 10 biggest things in tech, Wed, Sep 16

The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.

  1. Pixel zero-day actively exploited

    Google patched CVE-2026-58704, a zero-click privilege escalation flaw in Pixel cellular modems actively exploited in targeted attacks by likely surveillance vendors, with CISA issuing a three-day patching deadline for federal agencies; the September 2026 Pixel update also addressed 109 other flaws including 46 critical vulnerabilities.

    #1 · security · scored 9/10

  2. AWS data loss from wartime strikes

    AWS permanently lost customer data in Bahrain and UAE availability zones after Iranian drone strikes destroyed data center infrastructure, demonstrating that physical wartime attacks can defeat even multi-AZ redundancy architectures.

    #2 · platform · scored 8/10

  3. AI coding agents under attack

    Mandiant documented the Shai-Hulud worm spreading across ~100 repositories by hijacking an AI coding assistant session to recommend malicious packages, while Spain's AEPD reported the first AI agent-driven data breach where an autonomous agent chained vulnerability scans to exfiltrate personal data, signaling that AI development toolchains are becoming primary attack targets.

    #3 · security · scored 8/10

  4. Critical CVEs under active exploitation

    Multiple high-severity vulnerabilities are under active in-the-wild exploitation this week: WSO2 API Manager CVE-2026-5430 (CVSS 9.8, forged admin JWT tokens), Issabel Framework CVE-2026-89026 (CVSS 9.8, unauthenticated OS command execution via hard-coded JWT key), Acronis cPanel Backup Plugin CVE-2026-87886 (privilege escalation), and WooCommerce Wholesale Lead Capture CVE-2026-27540 (CVSS 9.8, PHP web shell upload with 100,000+ blocked attempts).

    #4 · security · scored 8/10

  5. AI safety evaluators and lab accountability

    Anthropic CEO Dario Amodei proposed embedding independent third-party evaluators (METR, Redwood Research) inside frontier AI labs with employee-like access, endorsed by OpenAI, Google DeepMind, and Meta CEOs, but security experts and third-party auditors warn the arrangement lacks legislative teeth and that basic network security should precede auditing, while Microsoft's Mustafa Suleiman publicly attacked Anthropic's approach as potentially 'disastrous.'

    #5 · ai · scored 8/10

  6. AI coding agent funding surge

    Factory raised $200M at a $5B valuation — tripling in five months — to deploy AI agents across the full software development lifecycle with customers including Nvidia and Adobe, while AIUC raised $40M Series A to provide insurance and security standards for AI agents, reflecting broad investor conviction that autonomous software agents are production-ready.

    #6 · ai · scored 8/10

  7. Open-source package registry sustainability push

    Google, Microsoft, Red Hat, and other major enterprises committed to sustainable funding for critical package registries (PyPI, npm, Maven Central, crates.io, RubyGems) facing 30–50% annual download growth, 1.8 million malicious packages in 2026, and AI-driven agents increasing vulnerability discovery 3–5x, with collapse a real risk without enterprise support.

    #7 · platform · scored 8/10

  8. C2PA content credential forgery on Pixel

    Researcher David Buchanan forged C2PA content credentials on a Google Pixel 10 by exploiting root access to sign arbitrary images as camera-authenticated, contradicting Google's November 2025 claims that StrongBox signing keys are extraction-proof, raising fundamental questions about photo provenance schemes — published after a 90-day responsible disclosure window.

    #8 · security · scored 8/10

  9. Java 27 ships post-quantum cryptography

    Oracle released Java 27 with post-quantum hybrid key exchange for TLS 1.3 (JEP 527) and compact 64-bit object headers as default (JEP 534) — reducing heap by 22% and CPU time by 8% — with Amazon and SAP already running the headers in production and no developer code changes required.

    #9 · backend · scored 7/10

  10. Claude unification and productivity agents

    Anthropic merged Claude Chat and Cowork into a single unified interface that auto-routes to tools, multi-step execution, and scheduled tasks, and added Claude Docs and Claude Slides in beta — a consolidation reported across TechCrunch, The New Stack, SD Times, and Simon Willison's blog, mirroring OpenAI's recent ChatGPT Work redesign and signaling AI assistants are converging on general-purpose agent interfaces.

    #10 · ai · scored 7/10