The bugs are piling up faster than the fixes.

CyberWire Daily roundup highlighting multiple active security stories: an IG critique of NIST's vulnerability database, Google patching an actively exploited Android zero-day, Citizen Lab's analysis of Penlink location-tracking, malware using Steam comments for C2, AI-assisted malware/EDR-evasion research, attackers hijacking Red Hat's npm namespace to steal cloud secrets, DriveSurge distributing malware via ClickFix and fake updates, a critical FreePBX hard-coded credentials vulnerability, Dashlane users impacted by brute-force attacks, and a Meta AI misuse case — plus an interview with Laure Lydon on security and privacy in digital health.