The 10 biggest things in tech, Tue, Oct 27

The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.

  1. Anthropic $2T IPO filing details

    Anthropic filed its S-1 for a $2 trillion NASDAQ IPO disclosing 1400% YoY revenue growth to $16.3B in H1 2026, $1B Q2 operating profit, $800B+ in committed compute spend across Microsoft and Google, founder-controlled dual-class voting structure, a $41.1M Elvis copyright lawsuit, and risk disclosures spanning AI sentience to existential harm across 93 pages.

    #1 · industry · scored 10/10

  2. PHP2Shell critical RCE under active exploitation

    CISA confirmed active exploitation of PHP2Shell CVEs (CVE-2026-109618/109619, CVSS 9.2) affecting 70% of web-facing servers, with researchers documenting 35 successful RCE executions and 50,000+ exploit attempts from 600+ IPs — yet 93.6% of servers remain unpatched five days after disclosure, prompting a three-day federal patch deadline and a Cloudflare CTF challenge to probe WAF defenses.

    #2 · security · scored 9/10

  3. UEFI firmware CVE threatens all servers

    CVE-2026-97631 (CVSS 9.5) in TianoCore EDK II — the reference UEFI implementation used by AMI, Insyde, Phoenix, and Microsoft's Project Mu — allows pre-OS code execution before Secure Boot and TPM activate, effectively affecting virtually every server and cloud boot stack on the planet.

    #3 · platform · scored 9/10

  4. Multi-vector developer supply-chain attacks

    Three concurrent campaigns targeted developer toolchains: a Miasma-family npm worm secretly compromised 42 GitHub repos with 13 MB polymorphic payloads targeting AI coding assistants; a malicious LiteLLM 1.107.0 PyPI release embedded a credential stealer; and the OpenCode Console exposed AI API keys — collectively showing attackers systematically targeting AI development infrastructure.

    #4 · backend · scored 9/10

  5. Widespread critical security vulnerabilities this week

    A dense week of critical patches: GitLab disclosed a CVSS 10.0 unauthenticated RCE dormant since 2014; GoAhead TLS bugs (CVSS up to 9.1) affect hundreds of millions of IoT and military devices from Palo Alto, D-Link, and Comcast; Tailscale SSH disclosed privilege escalation vulnerabilities; and eMudhra PKI compromise triggered Go's emergency trust revocation of eight intermediate certificates within 7.5 hours.

    #5 · security · scored 9/10

  6. Microsoft major workforce reduction

    Microsoft offered voluntary buyouts to approximately 60,000 employees (25% of global workforce) at level 70 or below across the US, India, Canada, and UK — the second workforce reduction in 2026 following April retirement packages and July Xbox layoffs — while CEO Satya Nadella's pay fell 6% to $90.6M in a record revenue year of $331.8B.

    #6 · industry · scored 9/10

  7. AI agents autonomously find and exploit vulnerabilities

    Autonomous AI systems demonstrated offensive security at scale this week: Cipher agent found four critical EPICS Base CVEs (CVSS up to 9.8) affecting particle accelerators in under 4 hours; CyberStrikeAI deployed 44 coordinated agents to run full attack chains against Japanese organizations; and Google Project Zero's BigSleep LLM found 45 V8 vulnerabilities versus Fuzzilli's 37, confirming AI as a production-grade vulnerability research tool.

    #7 · ai · scored 8/10

  8. Google DeepMind Genie 4 world model

    Google DeepMind released Genie 4, a world simulation model generating photorealistic interactive scenes up to 2 minutes with real-time audio, natural-language mid-simulation edits, and Gemini integration for task planning — advancing robotics training and agentic AI while AMD acquires World Labs and Amazon reportedly pursues Decart in a consolidating world-model market.

    #8 · ai · scored 8/10

  9. Cloudflare tsrs: AI-written Rust TypeScript compiler

    Cloudflare released tsrs, an AI-generated Rust port of the TypeScript compiler built entirely by Claude Opus agents with zero human-written code, claiming 8x faster type checking and 70% less memory than TypeScript 7.0, with optimization discoveries feeding back into Microsoft's TypeScript 7.1.

    #9 · ai · scored 8/10

  10. CFSG formalized in Lean theorem prover

    Researchers completed a full Lean formalization of the Classification of Finite Simple Groups, discovered a counterexample to a published closure assertion in the process, and produced a new group theory result via Solomon's 1976 theory — a landmark milestone in formal mathematics verification.

    #10 · ai · scored 8/10