Week in review: GitHub breached via poisoned VS Code extension, critical NGINX flaw exploited
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-45498+1 related CVE | Denial-of-Service Vulnerability in Microsoft Defender Antimalware Platform | 7.5 group max | 63% | KEV | KEV |
| CVE-2026-42945 | Heap Buffer Overflow in NGINX Plus & Open Source rewrite module — DoS, potential RCE | 9.2 | 68% | PoC ×6 | |
| CVE-2026-45585 | Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey" | 6.8 | 2% | PoC ×4 |
From the original article
5 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: GitHub, Grafana Labs breaches traced back to TanStack supply chain compromise GitHub CISO Alexis Wales has named the malicious VS Code extension behind the breach they suffered at the hands of the threat group TeamPCP: Nx Console, a popular developer tool with 2. 2 million installs.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.