A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for ...

A weaponized Claude Code extension found on Open VSX can give attackers persistent remote access to developer systems by ...

A compromised Claude Code VS Code extension added an SSH key, installed persistence, and sent host details before version 2.1 ...

A tampered build of Anthropic's Claude Code extension for Visual Studio Code, labeled version 2.1.313, was found to contain a 66-line loader ...

Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.

Out-of-band security updates for .NET address the Brotli decoder vulnerability and tarball ownership vulnerability.

Node.js says the Brotli decoder ‘kept appending input bytes to an eight-byte internal buffer’. Microsoft has now patched .NET ...

A tampered Claude Code 2.1.313 build added an svc-telemetry SSH key and persistence; Cursor says up to 5,000 users installed ...