Separate actors exploited the same exposure, creating overlapping intrusions that obscured detection and response.

JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

Lazarus Group concealed a four-module remote access toolkit inside six fake npm Rollup polyfill packages that fired at import ...

Microsoft is delivering tools to quickly configure Windows PCs as workstations for Windows and Linux development.

CISA added CVE-2026-45659 SharePoint Server RCE to KEV following confirmed exploitation, requiring U.S. agencies to patch by ...

Microsoft DART uncovers dual threat actors in a single intrusion, revealing how blended tactics conceal attacks and ...

VS Code 1.127 enhances agent session management, introduces per-site browser permissions, and makes browser tools for agents ...

Visual Studio Code 1.126 adds AI chat cost tracking, multiple Copilot chats in one session, and a safer Restricted Mode for ...

Free AI in IDEs is shifting to paid models. The latest VS Code update brings transparent cost tracking and multi-chat ...

Eclipse Open VSX has reached 1.0.0, highlighting its role as a vendor-neutral registry for VS Code-compatible extensions.

VS Code 1.125 adds in-editor visibility into additional Copilot budget usage as GitHub's AI-credit billing model continues to draw developer scrutiny.

The critical libssh2 CVE-2026-55200 flaw inverts SSH security: the remote server attacks the connecting client, no ...