Locked in heated rivalry with researcher, Microsoft fixes 0-day they disclosed

Aggregated Ars Technica security coverage (May–Jun 2026) highlights a wave of high-impact vulnerabilities, active exploit disclosures, and large-scale supply-chain incidents. Notable items include Microsoft patching a disclosed 0-day, a Linux kernel use‑after‑free introduced by a single character, a BitLocker bypass zero‑day, a critical ‘BadHost’ flaw in the widely used Starlette package threatening AI agents, and multiple package backdoors/credential‑stealers (including dozens of Red Hat packages via NPM and Microsoft packages laced with stealers). Other reports cover Dashlane vault thefts, a