Two Zero-Days Before Coffee

Google released emergency Chrome updates for two actively exploited zero-days — CVE-2026-3909 (Skia out-of-bounds write) and CVE-2026-3910 (V8 arbitrary code execution), both CVSS 8.8. The GlassWorm supply chain campaign escalated with 72+ malicious Open VSX extensions discovered targeting developers and AI coding assistants using transitive dependency poisoning. The medical technology wiper incident continues with no restoration timeline as the Intune weaponization is confirmed. And the Coruna iOS exploit kit has been traced to exploits originally developed by a defense contractor — closing the loop on the proliferation story from government-commissioned tools to mass criminal deployment.