The 10 biggest things in tech, Fri, Oct 23
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
PHP2Shell RCE crisis spreads
Critical RCE vulnerabilities PHP2Shell (CVE-2026-109618/109619) affecting 70% of websites triggered government outages across Europe, spawned Mirai botnet exploitation attempts within hours, and revealed a third related flaw (CVE-2026-115560), with AI-accelerated proof-of-concept development exemplifying a new norm where patch announcements signal active exploit availability.
#1 · backend · scored 9/10
Black October security wave
A clustering of critical disclosures across October overwhelmed defenders — GitLab CVSS-10 RCE (Ruby regex bugs), Node.js Brotli RCE (CVE-2026-111497), LiteLLM password stealer, Railway and Zeabur breaches, eMudhra CA weak-key scandal, and Quest Diagnostics healthcare data exposure — with monthly CVEs tripling to ~15k since April and state actors deploying AI-driven pentest framework ARTEX against 2,250+ Microsoft 365 tenants.
#2 · industry · scored 9/10
AI agents weaponized for intrusion
Researchers exposed Phantom, an AI-driven ransomware intrusion framework used by INC and Gentlemen affiliates, and METR/Redwood Research revealed OpenAI's own agent monitoring had critical gaps during Hugging Face attacks, while state actor Sandworm deployed a novel P2P mesh backdoor (MythicRatatoskr via Yggdrasil) against Ukrainian infrastructure.
#3 · ai · scored 9/10
UEFI and firewall credential attacks
Kaspersky reported APT41 actively exploiting BlackX UEFI bootkit (a BlackLotus variant) to bypass Secure Boot on unpatched Windows systems, while threat actor k0t stole 70,000+ credentials from exposed Fortinet and Palo Alto VPN appliances via two new CVEs targeting APAC organizations.
#4 · security · scored 8/10
eMudhra CA integrity failure
Indian certificate authority eMudhra issued eight TLS certificates with critically weak private keys (3–237 bits) exposing users to MITM attacks, then missed Mozilla's investigation deadline and blamed social media, signaling a systemic breakdown in CA accountability that threatens VPN traffic integrity globally.
#5 · security · scored 8/10
AI solves open math problems
OpenAI and Anthropic LLMs achieved landmark results in formal mathematics — including a counterexample to Erdős's 1946 unit distance conjecture, proof of the Cycle Double Cover, and a Navier-Stokes proof — while Claude separately produced formal security proofs at assembly level across 100+ production RISC-V libraries, discovering bugs in projects like the Linux kernel.
#6 · ai · scored 8/10
OpenAI valuation and funding race
OpenAI is negotiating a $30B funding round at a $1.25T valuation ahead of IPO, while backers including Eric Schmidt (stake worth ~$10B) and Iconiq ($17B) hold massive unrealized gains ahead of Anthropic's expected 2026 IPO at up to $2T valuation, reflecting the concentrated scale of AI funding.
#7 · industry · scored 7/10
Kimi K3.1 Pro open-weight launch
Moonshot's Kimi K3.1 Pro, an open-weight model with 1M token context releasing November 4, outperforms GPT-6 Astra on Terminal-Bench 4.0 and matches Claude Opus 5.5 at half the cost ($2/$10 per million tokens), with a Highspeed variant offering 2–3× throughput.
#8 · ai · scored 7/10
AI accelerates open-source security scanning
Anthropic launched OSS Scanner — a free Claude-powered service that identified 29,000 candidate vulnerabilities across open-source projects including PostgreSQL and wolfSSL over six months — while Red Hat unveiled Project Lightwell for AI-driven vulnerability remediation, reflecting a wave of AI-native security tooling aimed at open-source infrastructure.
#9 · ai · scored 7/10
x402 SDK payment-drain flaws
Security firm V12 disclosed three critical flaws in Coinbase's x402 AI-agent payment SDKs, including default clients with no spending limits that allow malicious APIs to drain full token balances; all three were silently fixed in August without public advisories.
#10 · ai · scored 7/10