The 10 biggest things in tech, Thu, Oct 22
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
PHP2Shell critical RCE crisis
AI tools from OpenAI and Google independently discovered two critical PHP vulnerabilities (CVE-2026-109618/109619, CVSS 9.2) affecting 70% of the web, with exploitation detected four days before coordinated disclosure, triggering mass outages across UK government, hospitals, and global institutions, a Chainguard embargo breach, and emergency patches in PHP 8.2.35–8.5.12.
#1 · backend · scored 9/10
Critical RCE flaws pile up
A wave of critical unauthenticated RCE vulnerabilities struck widely-deployed software simultaneously: GitLab patched a max-severity (CVSS 10.0) 12-year-old integer overflow (CVE-2026-110264), Linux KSMBD kernel SMB server exposed two CVSS 9.0 RCE flaws on public mailing lists before patches existed, and Node.js shipped fixes for a high-severity Brotli decompression out-of-bounds write across all supported versions.
#2 · security · scored 9/10
Arista VeloCloud zero-day exploited
Arista warned of an actively exploited CVSS 9.9 SQL injection zero-day (CVE-2026-114625) in VeloCloud Orchestrator allowing read-only customers to escalate to operator privileges, the third critical VCO vulnerability exploited since July 2025, with fixes in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12.
#3 · security · scored 9/10
AI-accelerated cyberattacks land
Chinese state-aligned hackers (Storm-0940) used open-source AI agent framework ARTEX to breach ConnectWise's cloud backup service, compromising 2,250+ Microsoft 365 tenants at 2,900 authentication attempts per minute and achieving privileged access in under three hours, demonstrating that AI-powered attack automation has moved from theory to operational reality.
#4 · security · scored 8/10
eMudhra CA collapses over weak keys
Indian certificate authority eMudhra exited the global SSL/TLS business after a researcher recovered private keys of eight intermediate CAs—one literally valued at 4—prompting Chrome to remove trust for emSign ECC Root CA - G3 on October 27, affecting ~30,800 unexpired certificates, with mitmproxy shipping an immediate mitigation option.
#5 · security · scored 8/10
Railway developer platform breached
Cloud developer platform Railway confirmed attackers accessed encrypted environment variables and API keys for a subset of customers, drained cryptocurrency wallets, and targeted AI inference provider integrations, forcing all users to rotate credentials and temporarily pausing deployments.
#6 · security · scored 8/10
LiteLLM supply-chain compromise
LiteLLM v1.107.0 was trojaned on October 21 via a suspected leaked GitHub token, injecting a credential-stealing RAT into PyPI and Docker Hub that harvested system, browser, cloud, and AI secrets via hourly GitHub dead drops, affecting any user who downloaded unpinned versions in a 104-minute window.
#7 · security · scored 8/10
Meta $25B New Mexico privacy fine
A New Mexico jury ordered Meta to pay $25 billion—its largest-ever penalty—after finding nearly 44 million consumer protection violations stemming from the Cambridge Analytica scandal and deceptive data control claims dating to 2010, following an $18B multistate settlement Meta had offered earlier.
#8 · industry · scored 8/10
AI agent infrastructure goes cloud-native
Google Cloud launched Agent Compute Engine (hardware-isolated microVMs for running hundreds of millions of agents), while AWS released Continuum for code vulnerabilities GA (AI-driven automated patching), NVIDIA released OpenShell 0.1.0 (kernel-level sandboxed agent runtime), and 1Password launched credential delegation for AI agents—marking a week where agent-specific compute and security infrastructure solidified across major vendors.
#9 · platform · scored 8/10
DeepSeek raises $15B amid US curbs
Chinese AI startup DeepSeek raised approximately $15 billion days after new U.S. restrictions, bringing total fundraising to ~$22 billion at a ~$71 billion valuation, with plans for a Chinese IPO and continued AI infrastructure buildout despite ongoing U.S. government security concerns.
#10 · ai · scored 8/10