GitHub says internal repos exfiltrated after poisoned VS Code extension attack

A string of high-impact security incidents and supply-chain attacks dominated the roundup: GitHub says internal repositories were exfiltrated after a poisoned VS Code extension, multiple npm/TanStack cache-poisoning and Shai-Hulud supply-chain compromises spread credential-stealing malware, and researchers flagged active exploitation of NGINX Rift and Linux kernel privilege-escalation flaws. Microsoft disrupted an illegal code‑signing operation used by ransomware gangs while other stories detail exposed secrets in open GitHub repos, a critically urgent Drupal core patch, macOS stealer/backdoor