The 10 biggest things in tech, Mon, Oct 12
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Meta Muse Wonder frontier models launch
Meta released Muse Wonder and Muse Wonder Full, its first frontier-class AI models trained at gigawatt-scale, claiming performance comparable to GPT-6 Astra and Claude Opus 5.5, priced at $4/$20 per million tokens via Meta Model API, backed by new OCP open networking infrastructure including liquid-cooled IcePack racks and 102.4T switches.
#1 · ai · scored 9/10
Supply-chain attacks hit npm and developer tools
Zod 4.6.6 was compromised with malware that fetches and executes arbitrary payloads via Ethereum contract interaction, while Codex CLI v0.157.0+ silently installs a persistent self-updating background daemon without user consent, representing back-to-back supply-chain trust failures in widely-used JavaScript developer tooling.
#2 · security · scored 9/10
GitHub major platform degradation
GitHub experienced a multi-hour degradation on October 12 affecting Actions, Issues, Pull Requests, and notifications, with notifications remaining delayed during backlog recovery — a major outage hitting core developer workflows.
#3 · platform · scored 9/10
Critical CVEs under active exploitation
Two CVSS 10.0 vulnerabilities are under active exploitation this week: CVE-2026-85097 enabling unauthenticated RCE via the Bricksforge WordPress plugin, and CVE-2026-102255 a pre-authenticated SSRF in SonicWall SMA 1000 appliances that saw 135 exploitation attempts within days of patching.
#4 · security · scored 9/10
AI-augmented cyberattacks escalate
Russian-speaking threat actor CyberXero used Anthropic's Claude Code to orchestrate campaigns stealing 628,000 Ukrainian records, while Anthropic's own Mythos model independently discovered and exploited a second vulnerability humans likely wouldn't find — and the FBI arrested a third ShinyHunters member — together signaling that AI is actively reshaping both offensive and investigative cybersecurity.
#5 · ai · scored 9/10
French supermarket cyberattack on refrigeration
A coordinated cyberattack exploited legacy Danfoss refrigeration controllers to remotely trigger defrosting across 400+ stores of E. Leclerc, Intermarché, and Cooperative U, destroying food inventory in a major critical-infrastructure attack with real supply-chain consequences.
#6 · security · scored 8/10
Google RCE bounty and slow fix
Security researcher Simon Köck earned a $90,000 bounty for an unauthenticated RCE vulnerability in Google's DevSite (developers.google.com) — exploiting a reused OAuth client secret in Flask session cookies to forge sessions across seven Google domains — but Google took two months to patch it despite its S0 severity rating.
#7 · security · scored 8/10
Microsoft Azure Maia AI chip scale-up
Microsoft announced Azure Maia 200 is now in production serving Copilot workloads, with Maia 300 launching in 2027 delivering 40% more tokens per megawatt and 7x rack-scale throughput, signaling a major shift toward custom silicon at multi-gigawatt scale for AI inference.
#8 · ai · scored 8/10
Ledger hardware wallet supply-chain compromise
Ledger halted sales through reseller CryptoBilis after discovering an unauthorized hardware implant in devices, with $86M in reported fund theft affecting Southeast Asia users — a serious physical supply-chain attack on cryptocurrency hardware.
#9 · security · scored 8/10
Ukrainian drone strikes on Yandex datacenters
Ukrainian drone strikes destroyed three major Yandex datacenters on October 7–9, taking Yandex Cloud, Mail, Maps, Search, and Yandex Pay offline and completely shutting the Sasovo facility, revealing Russia's centralized digital infrastructure vulnerability in an escalating 'data center war.'
#10 · platform · scored 8/10