The 10 biggest things in tech, Sun, Nov 1
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
Critical Linux/LXD CVEs under fire
A CVSS 9.8 use-after-free in the Linux TCP IPv4 handshake (CVE-2026-98432) enables remote unauthenticated root code execution — with Anthropic's Claude generating a working exploit — while a separate CVSS 10.0 flaw in Canonical's LXD and MicroCloud lets attackers impersonate trusted mTLS clients without a private key, both requiring urgent patching across Ubuntu, RHEL, and Amazon Linux.
#1 · security · scored 9/10
ChatGPT account takeover exploit chain
Parameter Labs disclosed a multi-step exploit chaining ChatGPT's HTML preview sandbox, MathLive's postMessage API, and YouTube oEmbed reflection to bypass CSP and execute authenticated API calls in victims' sessions via a single malicious share link — OpenAI patched the flaw on October 26 and paid a $5,000 bug bounty.
#2 · security · scored 9/10
AI-augmented malware targets developers and firms
Cisco Talos published technical analysis of VOLTA-AUTODOXER, an infostealer that uses LLMs via OpenRouter to rank stolen credentials by monetization value, while Chainalysis disclosed a breach where attackers used offensive agentic AI techniques to access internal tools and customer identity data — marking a new class of AI-weaponized cybercrime.
#3 · ai · scored 8/10
Meta Llama copyright litigation escalates
Ex-Meta researcher Stephen Roller testified under deposition that he torrented the pirated Books3 dataset and knowingly distributed it while employed at Meta, directly contradicting Meta's prior claims and substantially strengthening authors' copyright lawsuit over Llama model training data.
#4 · industry · scored 8/10
OpenBSD 8.0 major release
OpenBSD 8.0 ships with AMD64 virtual address space expanded from 4 GB to 512 GB, Intel Arc A-Series GPU support, ARM64 hibernation, RISC-V vector extensions, 64-vCPU multi-processor VMs, and LibreSSL 4.4.0 — a broad hardware and virtualization leap for the security-focused OS.
#5 · platform · scored 8/10
Crypto heists and supply-chain theft surge
The FBI attributed a record $6.43 billion Binance crypto theft to North Korea's TraderTraitor group, while hackers separately stole $2.7 million from 726 Polymarket traders by hijacking DebugBear's RUM script via DNS poisoning — underscoring both nation-state and supply-chain threats to crypto infrastructure.
#6 · security · scored 7/10
AI infrastructure politics and backlash
Data centers have become a US midterm election issue with nearly $200 billion in projects delayed or blocked, a federal judge allowed the NAACP's Clean Air Act suit over xAI's Colossus data center to proceed, and AWS capacity is reported largely sold out through 2027 — together signaling that AI infrastructure buildout is hitting political, legal, and physical limits simultaneously.
#7 · industry · scored 7/10
AI court filing prompt injection sanctioned
A Brazilian labor court issued what appears to be the world's first judicial sanctions for intentional prompt injection in a legal filing, fining lawyers ~$16,000 for embedding hidden instructions to manipulate the court's AI document review system (Galileu), establishing a legal precedent that AI-system integrity extends to machine-readable courtroom content.
#8 · security · scored 7/10
OpenSearch grows independent of AWS
Five years after forking from Elasticsearch, OpenSearch — now under the Linux Foundation — has cut AWS's contribution share from 91% to 72% and seen self-managed deployments grow faster than AWS's managed offering since 2024, though vendor-neutrality concerns still deter 24% of non-adopters.
#9 · data · scored 7/10
Cloudflare post-quantum GeoKey Manager beta
Cloudflare moved its post-quantum rebuild of GeoKey Manager into closed beta, replacing attribute-based encryption with hybrid ML-KEM-768/X25519 HPKE to combat harvest-now-decrypt-later threats, with GA planned for Q1 2027.
#10 · platform · scored 7/10