FBI director Kash Patel’s brand website taken offline after malware reports

Security Affairs roundup: a merchandise site for FBI director Kash Patel was taken offline after attackers used a fake Cloudflare page and a ClickFix technique to push malware. Drupal disclosed a highly critical SQL injection (CVE-2026-9082, CVSS 9.8) that is under active exploitation and was added to CISA’s KEV; CISA also added other high-profile flaws (including CVE-2025-34291). Anthropic’s Project Glasswing flagged 10,000+ high/critical vulnerabilities in one month, highlighting major patching gaps. Additional coverage details supply‑chain and npm compromises, a return of the Ghostwriter A­