Anthropic’s restricted Claude Mythos model may be coming to Claude Code

Roundup of multiple active security incidents and law‑enforcement actions: the FBI warns of the Kali365 phishing‑as‑a‑service platform abusing the OAuth device‑code flow to steal Microsoft 365 session tokens and bypass MFA; a large campaign is exploiting a critical Ghost CMS SQL injection (CVE-2026-26980) to inject malicious JavaScript in ClickFix flows; Laravel Lang packages were hijacked via GitHub tags to distribute credential‑stealing malware through Composer. Additional items include Trend Micro reporting an Apex One zero‑day in the wild, Drupal SQLi exploitation attempts, Ubiquiti patch‑