Dark Reading Confidential: This Threat Hunter Helped Cops Bust Up An African Cybercrime Syndicate

This Dark Reading digest highlights active, high-impact threats and vulnerabilities: a Qualcomm zero-day (CVE-2026-21385) is being exploited in targeted Android attacks (linked to commercial spyware or nation-state actors), and a long-exploited Cisco SD‑WAN zero-day (CVE-2026-20127) has been used in stealthy intrusions for years. Other notable items include a critical OpenClaw vulnerability and a supply-chain incident that pushed OpenClaw via a poisoned npm package, large-scale FortiGate compromises driven by generative AI tooling, exploitation tooling for React2Shell, and multiple ransomware/