Authorities dismantle First VPN, used by ransomware actors

Multiple security developments: European law enforcement (France, Netherlands, Europol, Eurojust) executed Operation Saffron, seizing 33 servers and taking offline First VPN — a service marketed to cybercriminals and used by ransomware actors. A TanStack supply-chain compromise (malicious Nx Console VS Code extension) attributed to TeamPCP led to credential theft and exfiltration of ~3,800 private GitHub repositories and impacted Grafana Labs. Microsoft confirmed active exploitation of two Microsoft Defender vulnerabilities — CVE-2026-41091 (local privilege escalation to SYSTEM) and CVE-2026-