What Changes When Your Software Supply Chain Includes AI Writing Your Code?

This collection highlights a surge of high-impact vulnerabilities, active exploitation campaigns, and novel malware frameworks affecting diverse targets (universities, government, critical infrastructure, developers). Notable items include nation-state and nexus actors exploiting Roundcube and Gitea flaws, a hidden admin backdoor in Tenda firmware, critical auth-bypass bugs in BeyondTrust products, a long-standing KVM guest-to-host escape (CVE-2026-53359), and a new Bad Epoll local root exploit (CVE-2026-46242). Supply-chain and developer-targeting activity is prominent — malicious npm/Packag-