CVE-2026-5426 enabled KnowledgeDeliver LMS attacks before February 24, 2026, leading to Cobalt Strike infections.
Packagist packages hid malicious package.json scripts, enabling Linux binary execution during installs and workflows.