The 10 biggest things in tech, Mon, Oct 19
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Critical Linux KVM guest-host escape
A 9.3-rated CVE (PwnEscape/CVE-2026-99999) in Linux KVM allows guest-to-host escape via malformed IPv4 packets, enabling arbitrary code execution or memory disclosure across thousands of co-hosted VMs, confirmed by Red Hat.
#1 · platform · scored 9/10
Developer supply-chain attacks surge
Multiple simultaneous supply-chain attacks hit developer ecosystems: the Rank Math PRO WordPress plugin was backdoored for 9 hours affecting all October 15–16 updaters, fake npm packages via a Web3 accelerator scam hijacked Anthropic/Google AI agent traffic, GhostAction attackers expanded from malicious GitHub Actions to npm stealers and OAuth phishing, and OpenCode's breach exposed OpenAI/Anthropic/Google API keys costing users up to $1,700 in unauthorized charges.
#2 · security · scored 8/10
Plex2Shell active exploitation chain
Attackers are actively exploiting a chain of four Plex Media Server CVEs (Plex2Shell) to install cryptominers and a Linux proxy backdoor, with honeypots detecting successful attacks within hours of the exploit's public release; Plex 1.43.3.10861 patches the flaws.
#3 · security · scored 8/10
Broadcom Wi-Fi forever-day router flaw
Researcher Quentin Kaiser disclosed WPSplinter, a 16-year-old unpatched Broadcom Wi-Fi flaw (BCM3380–68xx families) enabling unauthenticated root code execution on an estimated 1.56M+ routers, with older eCos-based devices permanently unfixable.
#4 · platform · scored 8/10
Linux kernel 7.3 released
Linux kernel 7.3 landed with 18,765 commits from 3,021 developers, introducing the failfs filesystem, fchroot() syscall, sched_ext subscheduler completion, BPF global per-CPU data, and SMB server improvements.
#5 · platform · scored 8/10
Diffusion LLMs reach production scale
Two diffusion-based LLMs — Mercury 3 (Inception) and MiniMax M3.1 Flash — both claim 1,000+ tokens/sec throughput matching or beating GPT-6 Luna and Claude Haiku 5.5 at $0.20/M input tokens, signaling diffusion architectures are competitive with transformer LLMs at scale.
#6 · ai · scored 8/10
AI agents breach enterprise systems
A hacker used an army of AI agents via the open-source Cairn engine to breach 100+ companies including John Deere and SharkNinja in ~23 hours with minimal human involvement, while researchers found Salesforce Agentforce and ServiceNow agents expose unauthenticated paths from the public internet into enterprise prompts.
#7 · ai · scored 8/10
ShinyHunters ransomware negotiator conflict
The FBI suspects an executive at a ransomware negotiation firm secretly helped operate the ShinyHunters extortion site, a group that has extracted over $70M in 2026, revealing a potential corruption at the heart of the incident-response industry.
#8 · security · scored 8/10
Meta Prometheus gigawatt supercluster
Meta detailed Prometheus, a gigawatt-scale Ohio supercluster using ~1M GPUs with closed-loop liquid cooling that achieved 85%+ goodput during pre-training and a mean time between interruptions of 54K GPU hours for its Muse foundational models.
#9 · ai · scored 8/10
UK Microsoft second-hand licensing ruling
The UK Court of Appeal rejected Microsoft's appeal of a ruling permitting resale of pre-owned Office licenses and ordered disclosure of an internal 2013 presentation, with a separate class action seeking £1.3–3.5 billion in damages.
#10 · industry · scored 8/10