Russian APT28 (Fancy Bear) exploited CVE-2026-21509 in Microsoft Office days after patch release Malicious DOC files sent to Ukrainian government agencies via themed phishing lures CISA added the flaw ...