Lazarus Group concealed a four-module remote access toolkit inside six fake npm Rollup polyfill packages that fired at import ...

One editor rewired my workflow ...

JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

VS Code 1.127 enhances agent session management, introduces per-site browser permissions, and makes browser tools for agents ...

LayerX found that BioShocking could trick AI browsers into leaking credentials by disguising malicious prompts as game rules.

A security researcher has released exploit code for a Visual Studio Code (VS Code) zero-day vulnerability that allows attackers to steal GitHub authentication tokens by tricking users into clicking a ...

VS Code 1.121 was released May 20, 2026, featuring yet another update to Claude Code, becoming more and more a first-class citizen in the VS Code ecosystem. Remote agents can run over SSH or dev ...

AI models are trained on the internet. The internet contains plenty of low-quality, insecure, and outdated code. To get consistently better output from AI coding assistants, you need to guide them ...

Preview of new companion app allows developers to run multiple agent sessions in parallel across multiple repos and iterate on human and agent reviews. Visual Studio Code 1.115, the latest release of ...

Today, you can use Google Messages for web using QR code pairing or Google Account sign-in. The original login method will soon go away. Opening messages.google.com ...

The Google Messages web app won’t allow users to pair using QR codes for much longer, according to a new warning. Users will instead have to sign in using their Google account credentials. We don’t ...