Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached