New XCSSET variant targets macOS devs via compromised Xcode projects

BleepingComputer security feed containing reports on active exploitation, malware campaigns, supply-chain attacks, credential and passkey theft, data breaches, and critical vulnerabilities. Notable items include exploitation of N-able N-central authentication bypass CVE-2026-18577, a critical Rails Active Storage flaw with potential RCE, XCSSET targeting macOS developers through compromised Xcode projects, a large npm supply-chain compromise, and attacks against Microsoft 365, Google-synced passkeys, and developer environments.