Backdoored Telnyx PyPI package pushes malware hidden in WAV audio

Multiple high-risk supply-chain and active-exploitation incidents were reported: a Telnyx PyPI package was backdoored to deliver credential-stealing malware hidden inside a WAV file (PyPI supply-chain compromise and steganographic payload), and a large GitHub campaign used fake VS Code alerts in Discussions to trick developers into downloading malware. The European Commission is investigating an AWS/cloud account compromise, and CISA warns that CVE-2026-33017 (Langflow) is a critical, actively exploited vulnerability used to hijack AI workflows. Additional notable items include targeted TikTok