GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos

A burst of high-impact activity across supply‑chain, browser, and infrastructure vectors: the GlassWorm campaign is using stolen GitHub tokens to force‑push obfuscated malware into hundreds of Python projects and is now abusing Open VSX (72 extensions) for transitive propagation. Multiple actively exploited and critical flaws were disclosed or patched this week, including Chrome zero‑days (e.g., CVE‑2026‑3909), Veeam Backup & Replication RCEs (CVE‑2026‑21666, CVE‑2026‑21667), and a widely exploited n8n expression‑injection RCE (CVE‑2025‑68613). Qualys’ “CrackArmor” AppArmor vulnerabilities can