Shai-Hulud malware worms Red Hat npm package versions downloaded 80K times a week

Collection of late-May–early-June 2026 security headlines showing a spike in supply‑chain and credential attacks and several actively exploited flaws. Notable incidents include the 'Shai‑Hulud' malware infecting Red Hat-packaged npm modules (~80K downloads/week) and a separate campaign publishing 14 malicious npm packages impersonating OpenSearch/Elasticsearch. Multiple high‑risk issues reported: active exploitation of a Palo Alto PAN‑OS VPN authentication‑bypass, an unpatched critical RCE in Gogs with an exploit module available, large data breaches and leaks (ShinyHunters/Charter/Carnival/My