This week’s biggest cyber stories all point to the same hard truth: attackers are scaling faster than defenders, using automation, stolen tokens, and software supply chains to hit everything from Next.js apps and npm packages to routers, PLCs, and AI tools. And in several of these cases, they didn’t even need malware to cause serious damage.