⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More

This week's cybersecurity recap covers major incidents including the Axios npm supply chain attack, multiple zero-day exploits, and new malware campaigns.

• •North Korean threat actors (UNC1069) compromised the Axios npm package (100M weekly downloads) to distribute cross-platform WAVESHAPER.V2 malware via the maintainer's hijacked npm account
• •Google patched Chrome zero-day CVE-2026-5281, a use-after-free bug in Dawn (WebGPU implementation), fixed in version 146.0.7680.177/178
• •Chinese hackers exploited TrueConf zero-day CVE-2026-3502 against Southeast Asian government entities by distributing tampered software updates via a compromised on-premises server
• •Fortinet FortiClient EMS critical flaw CVE-2026-35616 is actively exploited in the wild, enabling pre-authentication API access bypass leading to privilege escalation