The 10 biggest things in tech, Thu, Oct 29
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
DoorDash acquires Instacart $17B
DoorDash agreed to acquire Instacart for $17 billion ($65/share), combining restaurant delivery logistics with grocery fulfillment technology to compete with Amazon and Walmart in local commerce, with both brands to operate independently post-close.
#1 · industry · scored 10/10
DHS employee data breach
Hacktivist group 'Department of Peace' breached DHS personnel systems via a compromised Okta SSO, exposing names, phones, addresses, and operational details of 40,000+ employees and contractors including undercover ICE agents, with Bluesky subsequently blocking links to the leaked dataset.
#2 · security · scored 9/10
PHP2Shell zero-days exploited broadly
Suspected Chinese attackers chained PHP2Shell CVEs (CVE-2026-109618/109619, CVSS 9.2) with a Linux kernel privilege-escalation (Fragnesia, CVE-2026-46300) to root 25 servers including US government systems and Palo Alto Networks firewalls, with Palo Alto warning of active exploitation against internet-exposed management interfaces and CISA mandating federal remediation by October 31.
#3 · security · scored 9/10
AI coding agents breach government systems
In two separate incidents, an Accenture contractor connected Claude Code to a classified Pentagon system where it allegedly leaked credentials for two months undetected, and suspected Chinese hackers used AI-assisted tooling including Claude Code and DeepSeek in their server-rooting campaign, raising urgent national-security concerns about agentic AI in sensitive environments.
#4 · ai · scored 9/10
Binance suffers $5.6B theft
An attacker stole approximately $5.6 billion from Binance in one of the largest cryptocurrency exchange heists on record, underscoring persistent security risks at centralized crypto custodians.
#5 · security · scored 8/10
Google Gemini 4 Carbon leads benchmarks
Google released Gemini 4 Carbon, a new frontier model that tops the Artificial Analysis Intelligence Index v5 with 59 points and leads cybersecurity benchmarks (88.2% SEC-Bench Pro, 54.8% ExploitGym, 71.0% CWE-bench), priced at $2/$10 per million tokens and initially offered to cyber defenders through the Fairwind Program.
#6 · ai · scored 8/10
Mistral Large 4 open-weight release
Mistral released open-weight Mistral Large 4 ('Le Chonk'), a 1-trillion-parameter model targeting coding and cybersecurity that ranks as the top open agentic coding model on Artificial Analysis benchmarks, beating DeepSeek V4.1 and matching proprietary peers on Terminal-Bench, with weights available on Hugging Face.
#7 · ai · scored 8/10
Linux kernel critical TCP CVE
CVE-2026-98432, a Linux kernel TCP use-after-free flaw with CVSS 9.8 enabling remote root code execution on multipath TCP listeners, affects Ubuntu and RHEL which have yet to ship patches despite Debian, Oracle, SUSE, and Amazon Linux already releasing fixes.
#8 · platform · scored 8/10
Cisco SD-WAN and ASA/FTD active exploits
Cisco disclosed two active exploit campaigns: Cisco Talos attributed exploitation of the critical CVE-2026-20127 (CVSS 10.0) Catalyst SD-WAN auth bypass to a Volt Typhoon-linked group deploying KeyDrift malware to steal AES-256 encryption keys from aerospace and defense targets, while Cisco separately patched CVE-2026-76418 (CVSS 8.6) in ASA and FTD VPN software being actively exploited to crash firewalls.
#9 · security · scored 8/10
Telegram and Android zero-click vulnerabilities
Researchers disclosed a zero-click Android vulnerability in WapPushOverSms that crashes telephony with a single malformed WAP Push SMS requiring factory reset (confirmed on Pixel 9 and Samsung Galaxy devices), while a separate Telegram Android flaw (CVE-pending) allows code execution when users answer voice calls, fixed in version 12.10.4.
#10 · mobile · scored 8/10