President Trump authorizes private-sector companies to hack cybercriminals.

This briefing summarizes several active and high-impact security developments: a large supply-chain attack that compromised over 2,500 organizations via a malicious Trivy build that produced poisoned LiteLLM releases and deployed a credential-stealer; Microsoft’s Patch Tuesday fixing 421 vulnerabilities including three zero-days (one actively exploited and attributed to North Korea’s Lazarus Group); Apple notifying users in 110 countries of targeting by mercenary spyware and recommending Lockdown Mode; and research and policy items on AI-generated patches and new U.S. guidance enabling vetted private-sector offensive cyber actions alongside federal oversight.