U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case

A large batch of active threats and high-impact vulnerabilities reported by The Hacker News: a U.S. government entity paid ~USD 1M in a data-theft extortion case allegedly tied to a group calling itself Kairos; North Korea–linked supply-chain abuse publishing malicious packages and Chrome extensions (PolinRider) and npm packages impersonating Rollup tooling; seven newly disclosed FatFs filesystem vulnerabilities affecting millions of embedded devices; Bad Epoll local-to-root Linux/Android kernel exploit (CVE-2026-46242); a new modular Avalon malware framework with ransomware (CrownX) and multi