SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 98

Security Affairs roundup covering malware and vulnerability news: Drupal SQL injection CVE-2026-9082 (highly critical, CVSS ~9.8) is under active exploitation and was added to CISA’s KEV; CISA also added Trend Micro Apex One/Langflow issues including CVE-2025-34291. Other highlights include Anthropic’s Project Glasswing finding 10,000+ high/critical vulnerabilities, supply-chain compromises (infected node-ipc npm package, compromised GitHub Action, targeted antv packages), new Shai-Hulud/TeamPCP copycats, resurgence of Ghostwriter APT using a Ukrainian e-learning platform to deliver Cobalt Str