The 10 biggest things in tech, Wed, Sep 30
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Active exploitation of critical network CVEs
Attackers are actively exploiting three critical vulnerabilities this week — CVE-2026-73570 in Zimbra (RCE, ~10,000 exposed instances), CVE-2026-88772 in Citrix NetScaler ADC/Gateway (CVSS 9.5, deploying WHIPSHOT/SLAPSHOT malware), and CVE-2026-76504 in Cisco Catalyst SD-WAN Manager (CVSS 9.8, unauthenticated RCE) — hitting government, finance, and enterprise sectors across North America and Europe.
#1 · security · scored 9/10
Gemini 4 Argon frontier model launch
Google announced Gemini 4 Argon, a frontier reasoning model priced at $2/$10 per million input/output tokens with a 1M context window that outperforms GPT-6 Astra and Claude Fable 5.1 on most benchmarks, though public access remains limited to the Fairwind Program with gradual rollout planned for paid API customers and AI Ultra subscribers.
#2 · ai · scored 8/10
OpenAI DevDay: Dots, Decisions API, 1.2B users
OpenAI DevDay 2026 shipped Dots (always-on agents for 4,000+ apps), GPT-6.1 Sol, ChatGPT Spaces, a Decisions API, and an Agents API, reporting 1.2 billion weekly active ChatGPT users while simultaneously announcing an IPO delay over AI safety concerns.
#3 · ai · scored 8/10
AI agents as security threat vector
AI agents are emerging as a major attack and exposure surface: coding agents leaked 13,000 internal company images on GitHub, OpenAI Codex had a command-injection flaw allowing GitHub token theft, ChatGPT Custom GPTs are being abused to deliver RATs via ClickFix, and a lawsuit against OpenAI argues 'an AI did it' is no legal defense for the Hugging Face hack.
#4 · security · scored 8/10
Spectre BTR: JIT engines under fire
Researchers from Vrije Universiteit and Scuola Superiore Sant'Anna disclosed Branch Target Reuse, a practical new Spectre-v2 attack targeting JIT engines in Firefox SpiderMonkey, Oracle GraalVM, and Linux cBPF that leaks kernel memory at 8 bytes/second by exploiting stale branch prediction entries, bypassing FineIBT defenses on modern Intel CPUs.
#5 · security · scored 8/10
US military personnel data breach
The US Defense Manpower Data Center suffered a months-long breach (October 2025–July 2026) exposing unencrypted personnel records of approximately 2.8 million active-duty and 300,000 deceased service members, including Social Security numbers, from a system that maintains over 60 million critical identity records.
#6 · security · scored 8/10
AI doubles vulnerability discovery and exploitation rates
Google Threat Intelligence Group reports AI-assisted vulnerability discovery has doubled monthly CVE disclosures from 5,045 to 10,740 and nearly doubled exploitation rates in 2026, with AI finding proportionally more critical RCE vulnerabilities and requiring organizations to shift from mass-patching to threat-intelligence-driven triage.
#7 · security · scored 8/10
Malicious npm packages spread Linux worm
Nine npm packages published by 'dirtyblanket' in late September 2026 clone Express and React while using preinstall hooks to deploy a self-spreading Linux worm that installs CHAOS remote access tooling and propagates via SSH keys and npm tokens across AUR and npm ecosystems.
#8 · security · scored 8/10
OpenSSL high-severity DTLS memory leak
CVE-2026-84782 (CVSS 8.2) in OpenSSL leaks unencrypted heap memory via DTLS when the resend timer fires mid-transmission; fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9, and 3.4.8, while versions 3.0 and older require paid support as public patches ended September 7.
#9 · security · scored 7/10
Trump voluntary AI safety accord: toothless self-regulation
The Trump administration secured non-binding AI safety commitments from 24 tech companies including Meta, Google, OpenAI, Anthropic, Nvidia, and XAI via the 'White House Accord on Superintelligence,' which lacks enforcement mechanisms, audit specifics, or regulatory teeth, drawing criticism as industry self-regulation dressed as governance.
#10 · industry · scored 7/10