The 10 biggest things in tech, Sat, Oct 31
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Critical Linux TCP zero-day exploited
CVE-2026-98432, a CVSS 9.8 use-after-free in Linux TCP IPv4 (fixed in kernel 7.2.10/6.18.56), allows remote unauthenticated root code execution, with Ubuntu, RHEL, and Amazon Linux still unpatched as of Oct 29 and Anthropic confirming Claude generated a working exploit — illustrating how AI is compressing the patch gap from weeks to hours.
#1 · platform · scored 9/10
Ivanti Connect Secure chained exploits
CISA added two Ivanti Connect Secure CVEs to its Known Exploited Vulnerabilities catalog after threat actor UTA0576 chained them with an authentication bypass (CVE-2026-104935) to achieve unauthenticated root access, with patches available in versions 25.1.1.3 and 22.8R2.6.
#2 · security · scored 9/10
ChatGPT account-takeover via shared links
Researchers discovered and disclosed a P1-severity vulnerability in ChatGPT's shared-link Preview feature that chained a sandbox escape with MathLive library injection to execute arbitrary authenticated API calls in a victim's session — OpenAI patched it within 8 days.
#3 · frontend · scored 9/10
AI-augmented infostealer malware emerges
Cisco Talos documented VOLTA-AUTODOXER, a novel infostealer that feeds stolen credentials, crypto wallets, and metadata to LLMs via OpenRouter to rank victims by monetization value — a concrete first example of AI being weaponized for cybercrime triage at scale.
#4 · ai · scored 8/10
Meta Llama copyright litigation intensifies
A former Meta AI researcher testified under deposition that he torrented the pirated Books3 dataset and knowingly distributed it while at Meta, directly contradicting the company's earlier denial and strengthening authors' copyright lawsuit over Llama model training data.
#5 · industry · scored 8/10
AI agents find hundreds of real bugs
Google disclosed PageBreak, a Gemini-powered AI security agent that has found 500+ confirmed XSS vulnerabilities across Google's web applications since January 2026 with near-zero false positives by requiring working exploits before reporting.
#6 · ai · scored 8/10
OpenBSD 8.0 major release
OpenBSD 8.0 ships expanded AMD64 virtual address space (4 GB to 512 GB), Intel Arc A-Series GPU support, ARM64 hibernation, RISC-V vector extensions, up to 64-vCPU VMs, and LibreSSL 4.4.0.
#7 · platform · scored 8/10
AI-driven breach of Chainalysis tools
Chainalysis disclosed a breach in which attackers used offensive agentic AI techniques to access internal tools and non-sensitive customer identity data, marking a notable early public case of AI-assisted intrusion against a major crypto intelligence firm.
#8 · security · scored 7/10
Google AI Mode hurts Search revenue
Google reported AI Overviews reduced Search revenue by 15% — the worst decline since its 2004 IPO — as AI Mode queries monetize at lower rates, while OpenAI closed a funding round at $1.25T valuation after lowering its target from $30B to $20B amid tepid investor response.
#9 · industry · scored 7/10
xAI data center environmental lawsuit
A federal judge refused to dismiss an NAACP Clean Air Act lawsuit against xAI's Colossus data center in Memphis over unpermitted gas turbines, reinforcing that AI infrastructure builders face real legal accountability for environmental violations.
#10 · industry · scored 7/10