The 10 biggest things in tech, Thu, Oct 15
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Zero-click spyware via ad networks
Citizen Lab confirmed the first public technical case of zero-click mercenary spyware (Candiru) delivered through targeted online ads via Israeli firm Discover-Tech's Controlium platform, infecting 45 Al Jazeera devices across iOS and Android in 2024–2025 with no user interaction, exposing billions of internet-connected devices to ad-borne exploitation.
#1 · security · scored 9/10
Critical RCEs across major platforms
A wave of critical RCE vulnerabilities hit widely-used infrastructure this week: Next.js 16.4.1/15.5.28 patched two CVSS 9.5 flaws, NGINX 1.30.6 fixed three memory bugs (CVSS 9.2) plus a 20-year-old TLS client-cert bypass, Drupal patched an unauthenticated RCE path, Palo Alto Networks and Cisco both disclosed high-severity actively-exploited flaws, and Langflow's CVSS 9.9 authenticated RCE saw 1,423 honeypot exploit attempts.
#2 · security · scored 9/10
GhostAction GitHub supply-chain attack
The GhostAction campaign compromised ~1,900 GitHub accounts and injected malicious CI/CD workflows into 30,000+ repositories to steal AWS keys, GitHub/GitLab tokens, and AI provider credentials from OpenAI, Anthropic, and OpenRouter, escalating sharply in October 2026.
#3 · backend · scored 9/10
Linux kernel VM escape vulnerability
CVE-2026-99999 (PwnEscape), a CVSS 9.3 Linux kernel networking flaw, allows guest VMs to read ~32 bytes of host memory per packet, crash the host, or execute code, demonstrated against Vercel's production sandboxes and impacting all major cloud providers using Linux VMs.
#4 · platform · scored 8/10
Meta Muse Spark Open model launch
Meta launched Muse Spark Open, an 816B-parameter open-weight model with 42B active parameters and 1M token context, optimized for coding and agentic work, available locally on Apple M5 Ultra Mac Studios and via Baseten, Fireworks, Groq, and major cloud marketplaces, positioned as Meta's answer to leading Chinese open-weight models.
#5 · ai · scored 8/10
Anthropic revenue, IPO, and oversight
Anthropic reported Q3 2026 revenue of $16.8B (up 46% quarter-over-quarter) ahead of its IPO, while simultaneously granting METR researchers employee-level independent access to assess model safety, and facing an FTC formal investigation alongside OpenAI into AI model safety incidents.
#6 · ai · scored 8/10
Open-weight edge AI model race
Nvidia released Nemotron 3.5 Super VL (120B) and Bolt 74B-A9B for 24GB local inference, Liquid Intelligence launched LFM2.5-24B-A2B (2B active parameters, 184 tokens/s on M5 Max), and Mistral released Timestral time-series foundation models ranking first on multiple benchmarks — all competing for on-device and edge agentic workloads against Chinese alternatives.
#7 · ai · scored 8/10
AI coding agents reshaping development
Linus Torvalds used Claude Code to achieve a 23x Linux page-cache throughput improvement (though reviewers found a race condition), Anthropic built its own git replacement Scion handling 30,000 daily merges at 200x smaller infrastructure footprint, a developer ported the TypeScript compiler to Rust for $24,000 in AI tokens, and Meta documented shifting Forum development to human-on-the-loop agentic workflows.
#8 · ai · scored 8/10
OpenAI GPT-4o deprecation drama
OpenAI is retiring GPT-4o, GPT-4o mini, GPT-4.1, and GPT-4.1 mini on January 14, 2027, giving developers only three months' notice despite promising six, with the recommended replacement GPT-6 Luna introducing a rate-doubling pricing threshold at 272,000 input tokens that could disrupt RAG pipelines and coding agents.
#9 · ai · scored 8/10
Modal AI infra decacorn, $16B raise
Modal raised a $16B Series D at $1B ARR (3x in five months, 15x in one year), becoming NYC's newest AI infrastructure decacorn, with its Sandboxes product alone reaching $300M ARR after scaling to 3 billion spawned instances supporting 1 million concurrent workloads.
#10 · ai · scored 8/10