Polymarket customers lose $3 million in supply-chain attack

This collection highlights several active and emerging threats: a supply‑chain attack on Polymarket where a malicious script injected into the frontend via a third‑party vendor led to ~${3}M in customer losses (Polymarket will reimburse affected users); threat actors creating fraudulent OpenAI organization tenants to invite employees and harvest sensitive company data via chats/projects; Mandiant disclosures on in‑the‑wild exploitation of a Cisco SD‑WAN zero‑day (CVE‑2026‑20245) to create rogue root accounts; and new macOS malware (“Gaslight”) that hides prompt‑injection strings and embeds dec