project
Microsoft's free, open-source code editor supporting extensions, debugging, and remote development, widely used across programming languages and platforms.
No evidence-backed relationships are recorded.
Symantec says Warlock operators ran an AV/EDR killer across at least 40 machines in roughly two hours after a suspected SharePoint compromise. The ransomware payloads moved between domain controllers through SYSVOL replication.
Reality
China-linked Warlock operators hit at least four organisations through SharePoint flaws in two months, Symantec says. Its report lists six 2026 SharePoint CVEs only as possible additions, and the entry it documents is still older flaws on servers never patched or mitigated.
Reality
Microsoft released metadata from 301,026 GitHub Copilot agent sessions, covering 9.3 million LLM calls in one June week. Capacity planners now have real cache and token figures to test against, though the files measure resource use only and cannot show whether the output was any good.
Reality
Mandiant's findings say the intrusion never reached Checkmarx One or production AWS, and that answers the vendor's question rather than the one a customer has about what a build box pulled in late March.
Reality
Imperva found Microsoft's DebugMCP 1.1.4 let a malicious webpage run code on a developer's machine through an unauthenticated port 3001 listener. The fix reached 1.2.0 with no advisory, so finding exposed machines means checking installed extension versions.
Reality
Four governments have put a bureau name on the fake-recruiter campaign against software developers, and their alert says the same crews also work as North Korea's remote IT hires, from the same IP addresses.
Perspective Coverage
8 publishersReality
A dev.to writeup traces roughly 3,800 exfiltrated GitHub repositories to one trojanised Nx Console install from the official Marketplace, where the sandbox that would have contained it has been an open feature request since 2018.
Reality
The Rust Project's crates.io team says attackers posing as recruiters are luring team members and popular crate owners onto video calls that end in a pasted command. In August, one hijacked account shipped malicious crates.
Reality
OpenSourceMalware counted 4,367 infected repositories across 2,152 GitHub owners in July, and traced one maintainer through five months of advisory, cleanup and reinfection while the trigger sat in editor config.
Reality
A developer hit no diagnostics in Zed and WebGL-era false errors in VS Code, then wrote a Rust language server that hands each shader to glslang. The diagnostics inherit whatever glslang build it fetches.
Reality
Microsoft's Defender Experts date the Contagious Interview campaign to December 2022. Its payload lands at the one hiring stage where a candidate is expected to clone and run a stranger's code. The same team tells employers to give staff a non-persistent VM for coding tests.
Reality
A fresh terminal resolves ffmpeg while the IDE on the same machine says the tool is missing. The difference is the environment block each process got when it was created, and Windows sends no update to a process already running.
Reality
Seven agencies across four countries tied fake recruiters and take-home coding tasks to eight months of infections and drained cryptocurrency wallets.
Reality
Developer clients reach a key-protected Azure Functions MCP server by attaching a header; the Claude desktop app has no such field, and the one-click fix still left VS Code holding an invalid_target error from Entra.
Reality
For the first ninety minutes nobody opens an IDE. A mentor has to approve the team's SPEC.md, and that same file is what Antigravity or Cursor reads once the coding starts. It is worth 35 of the 100 points.
Reality
GitGuardian argues that credentials and permissions decide how bad an agent incident gets. Checked against the three 2026 disclosures it cites, the argument holds up, and only one of the three involved steering a model.
Reality
Socket reports no malicious stable release. The exposure sits with teams that resolve dev-* constraints directly, and with anyone who clones the repository and opens it in a VS Code-compatible IDE.
Reality
Cline's coding agent runs on one engine in four places, licensed Apache 2.0, with a CLI built to run headless inside pipelines and a Node SDK for teams that want to build their own agent on top of it.
Reality
GitGuardian says the ChainDrop worm reached 444 npm packages by planting a SessionStart hook in Claude Code and a folderOpen task in VS Code, and the publishing credential it steals is used to republish inside the same session.
Reality
AgentCore Identity now hosts the redirect leg and keeps the tokens, and what you configure in exchange is an OIDC application in your corporate IdP, a service role, and AWS's callback URL inside your GitHub and Slack apps.
Reality
Build · September 13, 2026 · 1 publisher
Product · August 14, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Build · September 10, 2026 · 1 publisher
Build · September 10, 2026 · 1 publisher
Build · September 9, 2026 · 1 publisher
Build · September 9, 2026 · 1 publisher
Security · September 8, 2026 · 1 publisher
Security · September 8, 2026 · 1 publisher
Build · August 31, 2026 · 1 publisher
Product · August 31, 2026 · 1 publisher
Build · August 30, 2026 · 1 publisher
Security · August 27, 2026 · 1 publisher
Build · August 27, 2026 · 1 publisher
Build · August 26, 2026 · 1 publisher
Build · August 25, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Build · August 22, 2026 · 1 publisher
Build · August 21, 2026 · 1 publisher
Build · August 19, 2026 · 1 publisher
Build · August 19, 2026 · 1 publisher
Product · August 16, 2026 · 1 publisher
Build · August 16, 2026 · 1 publisher
Build · August 16, 2026 · 1 publisher
Build · August 15, 2026 · 1 publisher
Build · August 15, 2026 · 1 publisher
Build · August 15, 2026 · 1 publisher
Build · August 15, 2026 · 1 publisher