Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

A security news digest covering active exploitation, critical vulnerabilities, malware and supply-chain campaigns, phishing innovations, exposed credentials, malicious AI-agent workflows, and abuse of generative AI. Key risks include unauthenticated Gitea file disclosure (CVE-2026-59774), actively exploited Langflow, Tomcat, and N-central flaws, Linux Open vSwitch local privilege escalation (CVE-2026-64531), npm worms and trojanized packages, ClickFix malware delivery, device-code phishing, and ransomware exploitation of SonicWall SMA vulnerabilities.