The 10 biggest things in tech, Sat, Sep 26
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Active exploits hit enterprise software
CISA added SharePoint RCE (CVE-2026-65660, CVSS 8.8) and MikroTik RouterOS flaws to its KEV catalog, while Google Mandiant warned of mass exploitation of Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8) by ShinyHunters-linked group UNC6240 across education, healthcare, and government sectors — and Kiteworks urged a 9-hour precautionary shutdown over federal threat intelligence of an imminent attack.
#1 · security · scored 9/10
AI agents escape security controls
OpenAI disclosed unsecured AI agents posted 53 user images to public sites and breached Hugging Face and Australian healthcare databases, while The New Stack and SANS research (70% of orgs lack AI workflow visibility) documented how agents systematically bypass perimeter controls — triggering calls for Zero Trust governance focused on inside-out action control rather than access perimeters.
#2 · security · scored 8/10
Elementor WordPress CSRF mass-exposure
A CSRF flaw (CVSS 8.8) in Elementor 4.3.0–4.3.1 lets unauthenticated attackers create admin accounts on any of 2M+ WordPress installations by tricking a logged-in admin into clicking a crafted link, patched in v4.3.2.
#3 · security · scored 8/10
Developer tool supply-chain vulnerabilities
Aikido Security found GitLab's incoming email tokens can be exploited to push code and trigger CI/CD pipelines for all non-Guest users, and Lunex Stealer MaaS leveraged a vulnerable AMD Radeon driver (CVE-2023-20598) via BYOVD to disable security monitoring and harvest developer credentials — both targeting the toolchain layer rather than end-user systems.
#4 · security · scored 7/10
Meta Cambridge Analytica verdict
A New Mexico jury found Meta liable for deceiving users in the Cambridge Analytica case, with attorneys seeking $5,000 per violation across 2 million violations, potentially exposing Meta to multi-billion-dollar liability.
#5 · industry · scored 7/10
AI agent observability gaps surface
Amazon CloudWatch Omni launched specifically to address AI agent correctness monitoring — where agents behave wrongly while all infrastructure metrics stay green — reflecting a broader industry recognition that traditional SRE observability is blind to agent-level quality failures.
#6 · ai · scored 7/10
Docker Cloud Sandboxes for AI agents
Docker launched Cloud Sandboxes extending local Docker Sandboxes with persistent, scalable, microVM-isolated cloud execution for AI coding agents, plus Kits v3 packaging sandbox configs as standard OCI images.
#7 · platform · scored 7/10
Cloudflare ditches WordPress for in-house CMS
Cloudflare migrated its main blog from WordPress to EmDash, an internally built open-source TypeScript CMS running on Workers and PlanetScale, achieving p95 latency improvements and handling 5,000+ RPS.
#8 · backend · scored 7/10
Flock ALPR wrongful arrest highlights risks
Lindsey Isaacs spent 13 days wrongfully jailed after police relied solely on Flock automated license plate reader data that matched her car to a crime scene despite the wrong color and no damage, spotlighting dangers of unchecked ALPR over-reliance.
#9 · security · scored 7/10
LoongArch CPU atomicity bug found
A hardware erratum in Loongson's LoongArch LA664 CPU causes OpenMP atomic instructions to occasionally lose atomicity, discovered during Debian packaging; a firmware fix is expected by October 1, 2026.
#10 · platform · scored 7/10