The 10 biggest things in tech, Fri, Oct 9
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
GitHub supply-chain credential theft
The 'GhostAction' campaign compromised 500+ GitHub accounts and injected malicious CI/CD workflows into tens of thousands of repositories, stealing 3,325 secrets including AWS keys and AI API tokens, while separately GitHub overhauled its own Git storage architecture from Spokes to a write-once Azure Blob model to handle AI agent traffic doubling to 473B events/month.
#1 · backend · scored 9/10
FBI disrupts Chinese Flax Typhoon botnet
The FBI seized seven domains and disrupted tools used by China-linked Flax Typhoon (Integrity Technology Group), which operated a 1.2M-device Mirai botnet targeting critical infrastructure worldwide, with CISA adding five exploited CVEs and seven governments issuing a joint advisory.
#2 · security · scored 9/10
Critical RCE vulnerabilities patched
Citrix patched a CVSS 9.5 RCE flaw in NetScaler ADC/Gateway SAML deployments (CVE-2026-107406), and researchers published a working root-access pre-auth exploit for AnyDesk Linux 8.0.2 that the vendor silently patched without a security advisory — with 8.1.0 reportedly still vulnerable.
#3 · security · scored 8/10
Cloudflare acquires Deno, expands platform
Cloudflare acquired Deno — the JavaScript runtime co-founded by Node.js creator Ryan Dahl — sunsetting Deno Deploy while integrating the team into Workers, and simultaneously launched K2, a serverless event streaming service built on R2 object storage with ~1-second p99 latency.
#4 · platform · scored 8/10
Decision-model AI funding and launches
TypeSafe AI raised $870M at a $7.5B valuation for Jev (a non-LLM calibrated-probability decision model with claimed one-third Fortune 500 adoption), Microsoft launched Microsoft-Decision-1 (36-benchmark leader, 35x faster than GPT-6 Sol) on Foundry, OpenAI shipped its Decisions API in public beta, and AWS/Upstage/Ollama standardized a decision-model API schema — signaling decision models as the week's breakout AI category.
#5 · ai · scored 8/10
Python 3.15 major release
Python 3.15.0 shipped with an upgraded experimental JIT compiler delivering 7–12% performance gains depending on architecture, UTF-8 default encoding, PEP 661 sentinel type, and improved typing features, contributed by 1,012 developers across 5,643 commits.
#6 · backend · scored 8/10
GitHub Copilot Rust rewrite milestone
GitHub migrated Copilot's runtime from TypeScript/Node.js to Rust via an AI-assisted rewrite of 800K+ production lines, cutting client startup time from 5.25 seconds to 292 milliseconds and eliminating 100 MB per-client overhead across 135 releases over 14.5 weeks.
#7 · backend · scored 8/10
Oxide Computer $445M Series D
Oxide Computer Company raised a $445M Series D led by Eclipse while reporting profitability, using the capital to fulfill a large hardware order backlog — a rare milestone of a rack-scale hardware startup reaching taxable income.
#8 · industry · scored 8/10
AWS AgentCore SSRF credential theft
Zenity Labs disclosed a critical SSRF vulnerability in AWS Bedrock AgentCore that allows attackers to extract temporary IAM credentials via agent prompts, enabling full account compromise due to Firecracker MicroVM's insufficient network isolation and overpermissioned default roles.
#9 · ai · scored 8/10
GoBalance Tor key hijack flaw
Searchlight Cyber disclosed a critical bug in the GoBalance Tor load balancer that exposes only half of a private key, allowing anyone with the public descriptor to recover the master key and hijack a dark web site's .onion address.
#10 · security · scored 8/10