'Dumbass' criminal breaks the 'first rule of ransomware club'

Aggregated security news roundup: multiple high-risk incidents and trends. Notable items include active exploitation of a Palo Alto PAN‑OS VPN authentication‑bypass flaw, an unpatched critical RCE in Gogs with a public exploit module, and widespread supply‑chain contamination of npm packages (Shai‑Hulud and impersonating OpenSearch/Elasticsearch packages plus large GitHub repo poisonings). Several large data breaches and leaks (ShinyHunters — Charter/Carnival), large-scale botnet/device takedowns, credential brute‑force against password manager Dashlane, and a prolific malicious domain/phantom