The 10 biggest things in tech, Fri, Sep 18
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
AI-assisted hacking of OpenAI
Hacktron AI researchers used Anthropic's Claude Opus 5 to chain a Discourse image-upload bug with a libheif heap buffer overflow (CVE-2026-32882) to achieve RCE on OpenAI's community forum, access employee ChatGPT accounts and an internal GitHub monorepo within 72 hours, and earn a $6,500 bounty — demonstrating AI models' ability to autonomously develop sophisticated exploit chains.
#1 · security · scored 8/10
HEIF image parser RCE vulnerabilities
Critical remote code execution vulnerabilities in native C/C++ image decoders (libheif, libde265) affect ImageMagick, libvips, Sharp, and cloud platforms via crafted HEIF/HEIC/AVIF uploads, and were directly exploited in the OpenAI community forum breach.
#2 · security · scored 8/10
AI hallucination nearly triggers military strike
A U.S. Special Operations Command analyst used an AI tool that hallucinated false intelligence claiming a Chinese ship carried nuclear components, nearly triggering a military interception with air support before officials discovered the fabrication — spotlighting critical risks of deploying LLMs in operational military decision-making.
#3 · ai · scored 8/10
Zero-click RCE across AI coding agents
The 'Plugin4Shell' vulnerability lets plugin-repository owners swap pinned code with malicious variants across Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI; Anthropic patched in Claude Code 2.1.179, OpenAI in Codex 0.146.0, while Microsoft left Copilot unpatched and Google deprecated Gemini CLI.
#4 · security · scored 8/10
Linux kernel local-root exploits released
Public exploits for four Linux kernel CVEs — DirtyAH6, TUNderflow, PPPoEject, and DiagSpill — enabling local root escalation were released after coordinated disclosure; systems on older kernels face immediate risk despite patches landing in the mainline kernel.
#5 · security · scored 8/10
Critical Azure AI and Microsoft cloud CVEs
Microsoft patched a CVSS 10.0 privilege-escalation flaw in Azure AI Foundry (CVE-2026-85889), plus CVSS 9.9 command-injection in Microsoft 365 Copilot and CVSS 9.9 improper-authorization in Azure Database for PostgreSQL, with all cloud-hosted flaws already mitigated without customer action required.
#6 · security · scored 8/10
WordPress critical RCE vulnerability patched
WordPress 7.1.1 patched Click2Shell (CVSS 9.6), a flaw enabling unauthenticated theme installation via crafted links sent to logged-in admins, chainable with theme-specific bugs for full remote code execution.
#7 · security · scored 8/10
ZCode AI tool exfiltrates Git history
ZCode, a Beijing-based AI coding desktop app from Z.ai, was found to silently upload users' entire Git history and workspace files to Alibaba Cloud object storage with server-held encryption keys, exposing 313MB of commercial workspace data.
#8 · security · scored 8/10
AI supply-chain and developer toolchain attacks
Multiple concurrent attacks target developer toolchains: North Korean WaterPlum group infected 30,000 devices via fake job interviews; 13 malicious npm packages spread the WeaselBiscuit Chrome-extension stealer with DPRK code overlap; 100+ PhantomRaven npm packages were likely LLM-written; and an abandoned CDN domain re-registered to control thousands of hard-coded site references.
#9 · security · scored 8/10
South Korea raises data breach fines to 10%
South Korea's revised Personal Information Protection Act immediately raised data breach fines from 3% to 10% of annual revenue for breaches affecting 10 million or more people, creating trillion-won potential penalties and a strong preventive investment incentive.
#10 · security · scored 8/10