This pack covers five high-priority intelligence items spanning software supply chain compromise, nation-state firmware implants, perimeter device exploitation, mobile ad fraud, and endpoint privilege escalation, all active or newly disclosed as of 2026-05-19. Two scenarios demand immediate organizational response: the Shai-Hulud Wave 3 npm supply chain attack (actively propagating, IDE persistence survives standard remediation) and the ArcaneDoor Firestarter firmware implant on Cisco firewall hardware (patching alone does not eradicate). Network perimeter integrity and developer environment credential hygiene are the dominant risk themes across this intelligence cycle.