The 10 biggest things in tech, Tue, Sep 22
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
ShinyHunters claims FBI data breach
Hacking group ShinyHunters claims to have breached FBI systems via an Oracle PeopleSoft zero-day, exfiltrating 2–3TB of employee and applicant data from AWS GovCloud — including names, home addresses, and spouse details — defacing the FBI jobs site and demanding the bureau retract statements about its harassment tactics, representing a major counterintelligence threat.
#1 · security · scored 9/10
AI-powered malware goes autonomous
Cisco Talos discovered CLOSEDQUORUM, the first documented Windows implant with fully autonomous AI-driven C2 that polls Gemini, DeepSeek, Qwen, and Mistral to select post-compromise actions without human operators, and released the open-source CAIRN toolkit to hunt AI-integrated malware — underscoring a new class of threat where LLMs replace traditional command-and-control infrastructure.
#2 · security · scored 8/10
EvilTokens AI phishing platform dismantled
Microsoft and UK law enforcement shut down EvilTokens, an AI-powered phishing-as-a-service platform that used an AI chatbot to analyze victim inboxes, draft targeted fraud messages, and compromise 12,000+ email accounts across 10,000+ organizations, seizing 50 websites and arresting two administrators in London.
#3 · security · scored 8/10
Critical CVEs across enterprise software
A wave of high-severity CVEs hit enterprise infrastructure this week: a CVSS 10.0 VeloCloud Orchestrator flaw under active exploitation, a CVSS 9.8 Check Point Management Server zero-day exploited in July, authenticated RCE in SharePoint misclassified as spoofing, a Linux KVM ARM64 guest-to-host memory escape, and active exploitation of Zyxel and Veeam flaws added to CISA's KEV catalog.
#4 · security · scored 8/10
WordPress critical RCE vulnerabilities patched
WordPress released emergency patches for multiple critical flaws affecting versions 4.7–7.1.x: an unauthenticated path traversal enabling conditional RCE (CVE-2026-87902, CVSS 9.2), an XSS-to-RCE chain via anonymous comments (Comment2Shell, CVE-2026-93485), and a separate authenticated RCE in SharePoint — urging immediate upgrades across legacy and modern themes.
#5 · security · scored 8/10
Anthropic Claude Opus 5.5 launch
Anthropic released Claude Opus 5.5, delivering Fable 5.1-level performance at 40% lower cost ($4/$20 per million tokens), 30% faster generation, 1M token context, improved cybersecurity safeguards, and demonstrated agentic coding efficiency — with Sonnet and Haiku 5.5 variants due within weeks.
#6 · ai · scored 8/10
OpenAI GPT-6 Sol and Luna launch
OpenAI launched GPT-6 Sol and Luna, cutting prices 80–90% versus predecessors (Sol at $2/million input tokens), halving factual errors versus GPT-5.6 Sol, and matching Anthropic Fable's coding benchmarks — both companies converging on a 'more capability for less cost' frontier strategy.
#7 · ai · scored 8/10
Meta Muse AI assistant security failures
Meta's Muse AI assistant, launched weeks ago with privacy claims, was found to contain a critical zero-day letting locally-run apps hijack agent control, inadvertently exported 6.8 GB of internal filesystem including SSH keys, and was admitted to be 'heavily inspired' by open-source OpenClaw — prompting Amazon to block it and raising broad questions about Meta's security practices.
#8 · security · scored 8/10
Malicious npm packages proliferate
Two sophisticated malicious npm packages emerged: indexed-btree (2M weekly downloads) hides malware in runtime code using Ethereum smart contracts as C2 to exfiltrate data via Slack/Telegram, while tw-pkgprobe-7731 masqueraded as a Twilio bug-bounty probe to harvest credentials and API tokens across 11 escalating versions.
#9 · security · scored 8/10
Bifrost AI gateway critical RCE flaw
A CVSS 9.8 vulnerability (CVE-2026-90898) in the Bifrost AI gateway allows unauthenticated remote code execution by default due to the official Docker image exposing the management API on 0.0.0.0 with auth disabled, fixed in transports/v2.1.0.
#10 · security · scored 8/10