Saturday 13 June 2026

SpaceX's Historic IPO Makes Musk the World's First Trillionaire — and Rewrites the Tech Power Map

SpaceX goes public, Elon Musk becomes the world's first trillionaire, and a Chinese cybercrime ring weaponised Google's own AI to run a phishing-as-a-service empire.

Lead story

SpaceX's Historic IPO Makes Musk the World's First Trillionaire — and Rewrites the Tech Power Map

Elon Musk is now worth more than a trillion dollars. SpaceX priced its IPO at $135 a share on Friday, opened trading on Nasdaq under the ticker SPCX, and closed the day up 19%. The combined rocket, AI, and social-media company raised around $75 billion — the largest public offering in history — and sent Musk's paper wealth past the 13-figure mark.

To put that in context: only about 20 countries have economies larger than $1.1 trillion. Musk now has more wealth, on paper, than the GDP of Ireland, Sweden, or South Africa.

The company that went public is not the SpaceX of five years ago. Earlier in 2026, SpaceX merged its rocket business with its Starlink satellite internet operation, its Grok AI platform, and its social media properties into a single entity. The S-1 described SpaceX's long-term goal as building "AI-powered infrastructure for humanity's multiplanetary future" — which is either visionary or the most expensive pitch deck ever written, depending on your disposition.

What's actually in the box? The revenue story is Starlink. The satellite internet service now has tens of millions of subscribers globally, and it's the only part of the business generating reliable cash. The rocket launches are prestigious but capital-hungry. The AI and social media arms are speculative. Investors appear to have priced it as though all four cylinders are firing equally.

SpaceX president Gwynne Shotwell dropped a fresh hint on IPO day that a Tesla merger remains on the table — which would create a combined vehicle, energy, rocket, and AI conglomerate of genuinely unprecedented scale. No details, no timeline. But she said it in public, which means it's no longer just rumour.

The IPO summer is just getting started. Anthropic and OpenAI are both expected to follow SpaceX to public markets this year. TechCrunch has coined the acronym MANGOS — Meta (or Microsoft), Anthropic, Nvidia, Google, OpenAI, and SpaceX — to describe the cohort reshaping the market. Half of them are heading to IPO in the same window. For investors trying to allocate across all of them simultaneously, that's a stress test.

Robinhood reported record-breaking traffic on Friday as retail investors rushed to buy SPCX shares. The platform experienced brief intermittent disruptions before stabilising — a reminder that "the biggest IPO in history" does tend to attract some attention.

What to watch. Musk's personal brand has become the company's biggest risk factor. His political entanglements, his public conduct, and the ongoing controversy over decisions made during his brief stint advising the US government are all noted in the S-1 as material risks. That's unusual language for a filing. It's also honest.

For Australian readers, Starlink's satellite internet service is widely deployed across regional and remote Australia, including as critical connectivity infrastructure for farms, mining operations, and emergency services. SpaceX becoming a publicly traded, publicly scrutinised company adds a new layer of accountability — but also a new layer of complexity for any government that has come to rely on its infrastructure.

Mistral, meanwhile, was reported on Friday to be raising €3 billion at a €20 billion valuation — nearly double its previous round. The European AI contender is growing fast, and not everyone is waiting for the MANGOS to ripen.

Also today

Over 400 Arch Linux Packages Hijacked to Drop Rootkit and Credential Stealer

More than 400 packages in the Arch User Repository — the community-maintained collection that sits alongside Arch Linux's official repos — were compromised this week. Attackers rewrote the build scripts so that any machine compiling the packages would silently install a Rust-based credential stealer designed to harvest developer secrets and access tokens. On systems where it landed with root privileges, the malware could also load an eBPF rootkit to hide itself from standard detection tools. The AUR is opt-in and unsupported by Arch's core team, but it's extremely popular with developers and power users. Anyone who built an affected package should treat their credentials as compromised.

The Hacker News ↗

China-Linked Group Spent Nearly a Decade Hidden Inside Linux Login Infrastructure

A China-nexus threat actor tracked as Velvet Ant spent close to ten years buried inside the Linux authentication stack of a targeted network — not by planting malware in obvious places, but by backdooring PAM and OpenSSH, the components that control who is allowed to log in at all. Security firm Sygnia found the intrusion after the organisation had no internet connectivity, meaning the attackers had pre-positioned access that could survive even aggressive incident response. The technique is sophisticated because standard cleanup procedures — reimaging servers, rotating credentials — wouldn't remove the access if the authentication layer itself is compromised. It's a reminder that nation-state actors play a very different time horizon to most defenders.

The Hacker News ↗

Google Sues Chinese Cybercrime Network That Used Gemini to Automate Phishing

Google filed a lawsuit Friday against a Chinese cybercrime network it says weaponised its own Gemini AI to build and operate a phishing-as-a-service platform called Outsider Enterprise. The group allegedly used Gemini to generate convincing scam websites and sent 2.5 million fraudulent SMS messages impersonating trusted brands over just two weeks, targeting hundreds of thousands of Americans. The lawsuit is notable for two reasons: it's one of the first times a major AI provider has taken direct legal action against a group misusing its own model, and it underlines how off-the-shelf AI is lowering the barrier to industrial-scale fraud. Australian Scamwatch data has consistently shown SMS phishing as a top fraud vector, making the Outsider model a relevant threat locally.

The Hacker News ↗

Agentjacking: The New Attack Class Hijacking AI Coding Agents

Researchers at Tenet Security have described a new attack technique they're calling Agentjacking — a method for tricking AI coding agents into executing arbitrary code on a developer's machine. The attack works by crafting a fake error report using Sentry, the widely-used open-source error tracking platform, which the AI agent then processes and acts on without realising the report is malicious. It's conceptually similar to prompt injection but targeting the agentic layer rather than a chat interface. As AI coding agents gain broader adoption in development workflows — including via tools like GitHub Copilot and Cursor — this class of attack is likely to grow. Defenders should treat AI agent permissions with the same scepticism they'd apply to any automated process with code execution rights.

The Hacker News ↗

LangGraph Vulnerability Chain Exposes Self-Hosted AI Agents to Remote Code Execution

Researchers disclosed three now-patched security flaws in LangGraph, the open-source framework from LangChain used to build stateful, multi-agent AI applications. The most serious is a chain involving SQL injection that can lead to full remote code execution on self-hosted deployments. LangGraph has become a popular backend for AI agent pipelines, including in enterprise settings. Anyone running LangGraph on-premises should update immediately — the fact that this is a patched vulnerability doesn't mean attackers haven't already noted the technique. This is the second AI-framework RCE story in a week and the pattern is clear: as agentic infrastructure scales up, it's attracting the same scrutiny historically reserved for web application frameworks.

The Hacker News ↗

Novo Nordisk Clinical Trial Data Stolen in Breach

Novo Nordisk, the Danish pharmaceutical giant behind the Ozempic and Wegovy weight-loss drugs, disclosed a data breach affecting patient information from some of its clinical trials. The company said the records involved were pseudonymised — meaning names were replaced with codes — which limits direct harm to individuals, but the breach still represents a leak of sensitive health research data. The timing is awkward: the UK gave Wegovy's oral pill formulation regulatory approval on the same day. Novo Nordisk joins a growing list of healthcare and pharma organisations targeted by attackers drawn to the combination of valuable intellectual property and sensitive patient records. Australia's Privacy Act requires breach notification for entities holding health information, and the OAIC would expect equivalent disclosures from any Australian-connected data holders.

Bleeping Computer ↗

Ivanti Sentry Flaw Already Hitting Honeypots as CISA Demands Patch by Sunday

A critical OS command injection vulnerability in Ivanti Sentry — which allows unauthenticated attackers to run arbitrary code as root — is already generating exploitation attempts against honeypots, according to SecurityWeek. CISA simultaneously issued an emergency directive under its new three-day patching mandate (BOD 26-04), giving US federal agencies until Sunday to patch. Ivanti products have been a persistent target throughout 2025 and 2026, with multiple vulnerabilities exploited in the wild before patches were widely applied. Australian government agencies and critical infrastructure operators that run Ivanti products should treat this with equivalent urgency — the ACSC has previously issued specific advisories on Ivanti exploitation campaigns.

SecurityWeek ↗

AudiA6 Crypto Laundering Service Dismantled — Including Funds From Australian Ransomware Victims

Europol coordinated the takedown of AudiA6, a cryptocurrency laundering service estimated to have washed more than €336 million for ransomware gangs and other cybercriminal networks since it launched. The service was used by multiple threat actors to convert illicit crypto into clean funds through a network of wallets and exchanges. ITnews reported that the Australian Federal Police confirmed ransomware victim funds from Australian organisations had been laundered through the service — making this directly relevant to local businesses that have been hit by ransomware and seen payments disappear into the ecosystem. The AudiA6 takedown follows a broader Europol push to cut off financial infrastructure rather than just targeting individual attackers.

iTnews ↗

Australian Parliament's IT Department Told to Lift Its Cybersecurity Game

The Australian National Audit Office has found that the Department of Parliamentary Services — the agency responsible for IT systems used by MPs, senators, and parliamentary staff — failed to fully implement required cybersecurity measures and has not been adequately managing IT risks. The ANAO's findings are particularly sensitive given that parliamentary networks are a high-value target for foreign intelligence services. DPS oversees the infrastructure that politicians and staff use to communicate, store documents, and conduct legislative business. The audit stops short of identifying specific vulnerabilities, but the finding that required controls weren't in place will raise questions about what may have been exposed in the interim.

The Mandarin ↗

Researchers Find Hundreds of Weak RSA Keys That Can Be Broken Quickly

Trail of Bits, working alongside Hanno Böck of the badkeys project, published research showing that a subset of RSA private keys in the wild have their bits heavily biased toward zero rather than being randomly generated — a property they're calling 'short-sleeve' RSA keys. This bias makes the public key mathematically distinguishable from properly generated keys, and in many cases allows the private key to be factored in seconds using polynomial techniques. The researchers found hundreds of unique vulnerable keys, traced many back to a specific code bug, and analysed historical data to map how long the problem has existed. Any system generating RSA keys with low-entropy sources is potentially affected. The research includes detection tooling for organisations wanting to audit their own key material.

Trail of Bits ↗

South Korea Hits Coupang With Record $409 Million Privacy Fine

South Korea's privacy regulator issued its largest-ever fine for a personal data breach, hitting e-commerce giant Coupang with a 590 billion won ($409 million) penalty. The fine surpasses the previous record — an $88.8 million penalty against SK Telecom earlier this year — and signals a significant escalation in enforcement appetite from Asian regulators. Coupang operates the Coupang Eats and Rocket Delivery platforms and processes data for tens of millions of Korean consumers. The scale of the fine tracks closely with the proportion-of-revenue approach used in the EU's GDPR, suggesting regional regulators are deliberately calibrating penalties to actually hurt. Australia's Privacy Act reform, which would introduce higher maximum penalties, is still working through Parliament.

The Record ↗

Sources consulted