FBI Warns Russian Hackers Target Signal, WhatsApp in Mass Phishing Attacks

A broad set of high-impact incidents and vulnerabilities were reported: Russian intelligence-linked mass phishing targeting Signal and WhatsApp for high-value account takeover; multiple critical unauthenticated RCEs and actively exploited zero-days (notably Oracle CVE-2026-21992, Cisco FMC CVE-2026-20131, GNU telnetd CVE-2026-32746, and Langflow CVE-2026-33017); large supply-chain compromises of the Trivy ecosystem including a self-propagating CanisterWorm and GitHub Actions tag hijacks to steal CI/CD secrets; Magento PolyShell unauthenticated upload/RCE; rapid exploitation of disclosed flaws;