A critical attack path in OpenCode, the open-source AI coding agent, could allow a malicious website to execute commands on a ...

Microsoft's public VS Code issue tracker on GitHub offers an unusually detailed look at features and changes the development team is considering -- including some that could eventually turn up in ...

The latest update to Microsoft’s code editor also expands Codex support in the agent host and previews automatic cleanup of ...

Next.js ImageResponse flaw can lead to server code execution when attacker-controlled values reach generated SVG.

On August 4, 2026, the Shai-Hulud npm worm returned for its sixth major campaign since September 2025 — and for the first time, it introduced three capabilities that no prior wave had shipped: ...

Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400 packages across multiple unrelated publishers, including packages associated with major ...

The Microsoft-led TypeScript 7.0 features an order-of-magnitude speed boost, a victory not only for TypeScript itself but also for Go, the programming language used to completely rewrite the web ...

Combinar Visual Studio Code, Git y Docker permite construir un espacio de trabajo reproducible: Visual Studio Code se utiliza para editar y depurar, Git conserva el historial del proyecto y Docker ...

A critical security vulnerability in Visual Studio Code’s webview implementation allows attackers to steal GitHub OAuth tokens, including read/write access to private repositories, simply by tricking ...

The post Mini Shai-Hulud: Frequently asked questions about the TeamPCP npm and PyPI supply chain campaign appeared first on Tenable Blog. A self-propagating worm has compromised more than 170 npm and ...

Three malicious versions of Microsoft's official durabletask Python SDK were published to PyPI on May 19, 2026. The compromised package silently downloads and executes a 28 KB payload that steals ...

Version 18.95.0 of the popular Nx Console extension (2.2M+ installs) was published with malicious code targeting developer credentials, cloud infrastructure tokens, and CI/CD secrets.