Relevant news, security threats, and vulnerability reports that affect developers, software pipelines, IDEs, and dev environments.

Versions prior to 2026.1.14 of mcp-server-git are vulnerable to data exfiltration through relative path traversal, allowing paths outside the repository to be added to the repo and exfiltrated by committing and pushing the repository.

There is no foolproof method of preventing all prompt injection attacks, but there are some ways to limit the scope of such an attack. This is not one of those ways.

Socket’s Threat Research Team dropped an incredibly detailed report on a Shai-Hulud-like supply chain worm that affects 19+ malicious npm packages. NPM Worm Credential Harvesting From their announc...

OX Security announced four new CVEs on VSCode extensions February 17, 2026. These four extensions had been downloaded 128M times.

A vulnerability in the AI editor Zed allows for an attacker to modify the zed settings.json file to add an arbitrary script as an Language Server Protocol. When the malicious LSP is triggered, the cod...

Simply opening a folder can give an attacker a foothold into all the code bases a developer maintains.