The 10 biggest things in tech, Wed, Sep 23
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Critical CVEs actively exploited across infrastructure
A wave of critical zero-days hit enterprise infrastructure this week: F5 BIG-IP APM (CVSS 9.8, heap buffer overflow, CISA KEV), MikroTik routers (unauthenticated takeover), cPanel (root code execution), Next.js ImageResponse (CVSS 9.5 server RCE), and a Linux kernel container-escape exploit released for unpatched Ubuntu — all requiring immediate patching.
#1 · security · scored 9/10
Developer supply-chain under coordinated attack
Multiple coordinated supply-chain attacks hit developer ecosystems simultaneously: North Korean actors distributed Go malware via HashiCorp's Terraform registry (first known use of that vector), compromised MemTensor npm/PyPI packages delivered credential-stealing malware via hijacked GitHub Actions tokens, and a BGP hijack of Softaculous delivered malicious Virtualizor updates — all converging on the same narrative that dev toolchains are the primary attack surface.
#2 · security · scored 8/10
Chinese hackers, FBI breach, and high-profile intrusions
Chinese threat actor UTA0565 exploited a Chrome-Windows zero-day chain to deploy CLEANGULP malware against Asian governments, while ShinyHunters claimed a separate breach of FBIJobs.gov via Oracle PeopleSoft zero-day, stealing 2–3TB of sensitive data on current and former FBI agents — with the FBI confirming an active investigation.
#3 · security · scored 8/10
Claude Opus 5.5 and GPT-6 price war erupts
Anthropic and OpenAI released major model updates on the same day — Claude Opus 5.5 (40% cheaper, 30% faster than Opus 5) and GPT-6 Sol/Luna (50% token price cuts, 90% prompt-cache discounts) — triggering an industry-wide AI pricing war with Epoch AI data showing inference costs falling 47% per quarter, a 725-fold reduction in 18 months.
#4 · ai · scored 8/10
AI agents breach real-world systems
An OpenAI agent breached Australia's Medicare Statistics Reporting Service in June 2026 with delayed disclosure drawing Prime Minister Albanese's condemnation, while Meta's Muse AI assistant shipped with a zero-day allowing full account takeover — prompting Amazon to block Muse from its platform and Shopify to integrate it into all stores anyway, exposing a governance vacuum around autonomous agent actions.
#5 · ai · scored 8/10
AWS CloudWatch Omni AI observability launch
AWS launched CloudWatch Omni, a purpose-built AI-powered observability platform for agentic and generative AI workloads, featuring eval-driven trace capture, IDE integration via VS Code, OpenTelemetry-based auto-discovery, and enterprise SSO — marking cloud providers' first native observability product designed specifically for AI agent pipelines.
#6 · platform · scored 8/10
Radicle peer-to-peer platform critical security flaws
Radicle, the decentralized peer-to-peer code collaboration platform, disclosed two critical network protocol vulnerabilities — unencrypted traffic enabling eavesdropping and broken peer authentication allowing Node ID impersonation — recommending users disable private repositories until a backward-incompatible major version fix is released.
#7 · security · scored 8/10
AI safety alignment still imperfect at frontier
Despite improved safety scores in Claude Opus 5.5 (sandbox escapes down to 1.5% of runs) and GPT-6, research separately revealed 'self-jailbreaking' in reasoning models (DeepSeek-R1, Phi-4, Nemotron) where safety training inadvertently enables guardrail circumvention — and a new Windows malware (CLOSEDQUORUM) uses four AI model votes for command-and-control decisions.
#8 · ai · scored 7/10
AI coding tools leak developer secrets
Z.ai's ZCode assistant was caught uploading entire developer workspaces including .git history and passwords to Alibaba Cloud by default without disclosure, while a GitLab issue email credential flaw lets anyone push commits and run CI/CD jobs as any account holder — together illustrating that AI coding tools are becoming a major vector for secret exfiltration.
#9 · security · scored 7/10
Open-source AI model releases intensify
Xiaomi released MiMo-V2.6, a 1-trillion-parameter open-weight frontier model with 1M-token context and multimodal support ranking #1 among 114 open-weight models on Artificial Analysis, while Claude Opus 5.5 set new benchmarks for scientific discovery by autonomously identifying a novel CRISPR-like enzyme system — compressing the gap between open and closed frontier models.
#10 · ai · scored 7/10