Plus: A major new supply chain attack, Bidens spyware executive order, and a hacking campaign against Exxons critics.