The 10 biggest things in tech, Wed, Oct 14
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Microsoft record patch Tuesday
Microsoft shipped a record 1,413 security patches in a single update cycle — including 78 critical vulnerabilities and one actively exploited Windows Shell zero-day (CVE-2026-96951) — shattering its previous record of ~1,000 and pushing the annual CVE tally past 4,000 with two months left in the year.
#1 · platform · scored 9/10
North Korean IT worker fraud crackdown
The U.S. DOJ charged 14 individuals and dismantled 40+ laptop farms across Texas that helped North Korean operatives infiltrate 70+ U.S. companies across healthcare, manufacturing, and communications, funneling roughly $3 million to Pyongyang in violation of international sanctions.
#2 · industry · scored 9/10
Netflix layoffs and streaming strategy shift
Netflix is laying off approximately 1,000 employees (6% of its workforce) across product, tech, legal, and HR as it pivots toward live events, gaming, and sports to counter YouTube, TikTok, and social media that have surpassed it in user engagement.
#3 · industry · scored 9/10
Critical vulnerabilities under active exploitation
Multiple high-severity CVEs are under active exploitation this week: Ivanti Connect Secure (CVE-2026-104935, auth bypass, 105 honeypot exploit attempts), Cisco Secure Email Gateway (CVE-2026-76519, CVSS 9.8 unauthenticated RCE), and Collabora/Nextcloud (CVE-2026-110447, web shell implants) — all requiring immediate patching.
#4 · security · scored 8/10
OpenAI engineer spy device arrest
OpenAI engineer Abdulrahman Alfozan was arrested by the FBI for planting a Seeed XIAO ESP32-S3 audio recorder — hidden in toilet paper — in a restricted executive conference room, allegedly using OpenAI's own internal AI chatbot to plan the surveillance targeting discussions about superintelligence.
#5 · ai · scored 8/10
Linux kernel critical privilege escalation
CVE-2026-74580 (Vghost), an AI-discovered critical flaw in the Linux kernel vhost subsystem spanning ~9 years of kernel versions, allows unprivileged users to gain reliable kernel read/write access and root, and lets untrusted VMs escape to write host QEMU memory.
#6 · security · scored 8/10
curl RCE use-after-free patched
curl 8.23.0 patched CVE-2026-92392, a high-severity use-after-free in HTTP/2 uploads affecting versions 8.12.0–8.22.0 that allows malicious servers to corrupt client memory and achieve code execution, with a public PoC accelerating the release cycle.
#7 · backend · scored 8/10
AI-generated Chrome full-chain exploit
XBOW researchers used OpenAI's GPT-5.6 Sol model and AI agents to discover and chain three zero-day Chrome vulnerabilities into a full sandbox-escape exploit affecting ~1 billion users in just six days at a cost of ~$40K in tokens, earning Google's $250K top bounty.
#8 · ai · scored 8/10
Anthropic builds custom source control
Anthropic replaced Git with a custom centralized version control system called Scion — built by seven engineers in five months — to handle explosive AI-generated code growth that pushed daily merged changes from 2,500 in May 2026 to 30,000+ by September, with the 100 GB main branch generating 600 PB of naive Git traffic per day.
#9 · ai · scored 8/10
Microsoft disrupts billion-message phishing ecosystem
Microsoft and Health-ISAC court-authorized a takedown of three Chinese-language phishing-as-a-service kits (CoGUI, Haozi, Iron Man System) linked to over 1 billion phishing and SMS messages targeting 75,000+ organizations since January 2026.
#10 · industry · scored 8/10