SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 93

Feed of Security Affairs headlines: researchers report attackers abusing QEMU to hide malware inside virtual machines for stealthy data theft and ransomware deployment; a Nexcorium Mirai variant is exploiting a TBK DVR flaw (and outdated TP‑Link routers) to build DDoS botnets; three Microsoft Defender zero‑days (BlueHammer, RedSun, UnDefend) are being exploited with at least two still unpatched; ZionSiphon is a politically motivated malware targeting Israeli water systems (attempting to alter pressure/chlorine); CISA added Apache ActiveMQ CVE-2026-34197 (CVSS 8.8) to its Known Exploited Vulner