36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants

Multiple high-impact security incidents and active-exploitation vulnerabilities were reported: researchers found 36 malicious npm packages masquerading as Strapi plugins that deploy Redis/PostgreSQL exploits, reverse shells and persistent implants; Fortinet released an out-of-band patch for an actively exploited pre-auth privilege-escalation bug (CVE-2026-35616); Google/others attributed the Axios npm supply-chain compromise to North Korean UNC1069 following targeted social engineering; a Chrome zero-day in Dawn (CVE-2026-5281) is under active exploitation and patched; Cisco patched a critical