Week in review: GitHub breached via poisoned VS Code extension, critical NGINX flaw exploited