Self-propagating malware poisons open source software and wipes Iran-based machines

A series of high-impact security incidents reported by Ars Technica in early 2026 highlight an active, multi-pronged threat landscape: ongoing supply-chain compromises (including a widely used Trivy scanner compromise, invisible/unicode code insertion on GitHub, and malicious packages targeting dYdX) and a self‑propagating malware campaign that poisoned open‑source software and wiped Iran‑based machines. Other major items include a powerful iPhone exploit/tool called “DarkSword” seen in the wild, disclosed vulnerabilities in IP‑KVMs (BIOS‑level access), ~14,000 routers (many Asus) infected by难