Backdoored Telnyx PyPI package pushes malware hidden in WAV audio

Multiple active threats and high-risk incidents reported: a Telnyx PyPI package was backdoored to deliver credential‑stealing malware hidden inside a WAV file (supply‑chain compromise), and a large campaign used fake VS Code alerts in GitHub Discussions to trick developers into downloading malware. CISA warns of active exploitation of a critical Langflow vulnerability (CVE-2026-33017) used to hijack AI workflows. Separately, the European Commission is investigating an Amazon cloud account breach, and multiple phishing campaigns (including attacks on TikTok for Business and Dutch police) and iO