U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case

A roundup of active high-impact threats and vulnerabilities: a U.S. government entity paid ~ $1M in a Kairos data-theft extortion case; North Korea-linked PolinRider activity published 108 malicious packages and npm supply-chain impostors; runZero disclosed seven FatFs flaws affecting millions of embedded devices; Bad Epoll Linux kernel privilege-escalation (CVE-2026-46242) affects Linux and Android; a new Avalon modular malware framework with CrownX ransomware capabilities was observed; multiple stealers and multi-stage campaigns (PamStealer, PureLogs via VEIL#DROP, AsyncRAT via SEO-poisoned/