Week in review: GitHub breached via poisoned VS Code extension, critical NGINX flaw exploited

This weekly roundup highlights several high-impact security developments: a supply‑chain breach traced to a malicious VS Code extension (Nx Console, ~2.2M installs) attributed to threat group TeamPCP that led to GitHub and Grafana Labs intrusions; active exploitation of a critical NGINX vulnerability; and law‑enforcement action against the operator of the KimWolf DDoS botnet (over 1M infected devices). Other notable items: researchers demonstrated low‑cost AI‑driven discovery of WordPress plugin zero‑days (~$20 per exploit); deleted Google API keys can remain valid for up to 23 minutes risking