Apple Sends Lock Screen Alerts to Outdated iPhones Over Active Web-Based Exploits

Multiple high-impact supply‑chain and active-exploitation incidents were reported: TeamPCP pushed malicious versions of telnyx (PyPI) and backdoored litellm via a Trivy/KICS CI compromise to steal credentials and enable lateral movement; researchers disclosed an Open VSX pre‑publish scanning bug that allowed a malicious VS Code extension to bypass vetting; and Apple is issuing Lock Screen alerts for active web‑based iOS/iPadOS exploits. Additional critical findings include LangChain/LangGraph flaws that can expose files and secrets, a zero‑click XSS/prompt‑injection flaw in Anthropic’s Claude‑