Meta’s recovery plan needed recovery.

This CyberWire Daily briefing summarizes multiple active cyber incidents and industry news: a Meta support-tool bug that exposed roughly 20,000 Instagram accounts, CISA reporting active exploitation of a SolarWinds Serv-U vulnerability (CVE-2026-28318), WordPress sites being compromised via the Everest Forms plugin, a new Gafgyt botnet variant spreading through a DD-WRT router flaw, and a Pink extortion group stealing Microsoft 365 cloud data through vishing and legitimate tools, alongside other legal and industry developments.