actively-exploited Defender flaws on a 14-day CISA clock, GitHub's 3,800-repo breach in the TeamPCP/TanStack supply-chain campaign, First VPN takedown, SS7 ghost-operator tracking, on-prem Exchange zero-day, plus ransomware-as-terrorism and Lotus Wiper signals.