Clean GitHub repo tricks AI coding agents into running malware

Multiple high-impact threats and techniques observed across the ecosystem: AI coding agents can be tricked into executing malware hidden in otherwise benign GitHub repos; Russian-linked phishing campaigns are now targeting Signal Backup Recovery Keys to access historical messages; CISA issued an urgent patch deadline for an actively exploited vulnerability in Cisco Unified Communications Manager Server; a third‑party supply‑chain injection caused Polymarket to lose ~$3M in customer funds; threat actors are using fraudulent OpenAI organization invites to harvest company data; macOS ‘Gaslight’ (