Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers

BleepingComputer reports a broad set of cybersecurity developments, including North Korean-attributed npm supply-chain attacks, critical VMware vulnerabilities enabling authentication bypass, arbitrary code execution and VM escapes, Teams-based vishing leading to Chaos ransomware, Russian exploitation of an Exchange OWA zero-day, active exploitation of Cisco FMC static credentials (CVE-2026-20316), attacks against healthcare and water utilities, and multiple corporate data breaches. The most urgent items involve actively exploited zero-days and attacks affecting critical infrastructure.