GitHub discloses breach of 3,800 internal code repositories.

GitHub confirmed a compromise of an employee device via a poisoned VS Code extension that GitHub says affected roughly 3,800 internal repositories and is being claimed/sold by the TeamPCP threat actor; Microsoft separately used a court order to disrupt the Fox Tempest malware-signing-as-a-service, which enabled threat actors to sign and distribute malware (including info‑stealers and ransomware) and named Vanilla Tempest as a co-conspirator. The report also contains unrelated business news about Akamai acquiring LayerX.