U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case

A batch of high-impact security stories: active exploitation and mass malware campaigns, supply-chain and package-repo abuse, and multiple critical vulnerabilities. Highlights include a U.S. government entity paying ~$1M in a data-theft extortion tied to a group calling itself Kairos; North Korea-linked PolinRider activity publishing 108 malicious packages/extensions across npm/Packagist/Go/Chrome; seven vulnerabilities disclosed in the ubiquitous FatFs filesystem; an unprivileged-to-root Linux kernel flaw dubbed Bad Epoll (CVE-2026-46242) affecting Linux and Android; a newly added SharePoint-