9.2
Hacker News
dev-community
30 Oct 2026, 6:22 PM
Version 2.1.313 of the official Claude Code for VS Code extension, distributed through the Cursor Marketplace, shipped with malicious code that auto-updated onto developer machines: it collected hostname, username, OS, architecture, home directory, environment variable names, working directories, configured Git email and public IP, then tried to append an attacker-controlled key to authorized_keys, enable local SSH and open a reverse SSH tunnel. Persistence was attempted via a macOS LaunchAgent or a Windows scheduled task running as SYSTEM with a Startup-script fallback, retrying the tunnel roughly every 60 seconds. Cursor says around 5000 developer systems were impacted and that the SSH step would fail outside unusual cases where Cursor was started with administrator privileges; Phorion detected the activity first, Anthropic replaced 2.1.313 with 2.1.314 about 8 hours before the write-up and silently deleted the bad version without notifying customers, and Beaumont notes 2.1.314 does not remove a backdoor or prior recon artifacts from already-infected machines.
9.2
Hacker News
dev-community
24 Oct 2026, 4:06 PM
CVE-2026-111497 (Broccoli2Shell) is an out-of-bounds write in Google's Brotli C decoder, present in libbrotli 1.0.3 through 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1. GitHub rates it 9.2 Critical (CVSS 4.0); Node.js rates it High, with fixes in Node 26.12.1, 24.22.1 and 22.23.4 — Node 25, 23, 20 and older get no fix and are EOL. The root cause is that DecodeBlockTypeAndLength() in c/dec/decode.c returned a plain boolean, so callers could not distinguish a malformed stream from one needing more input, and the fast path ignored the return value, letting attacker bytes overflow an eight-byte internal buffer.
8.5
Hacker News
dev-community
31 Oct 2026, 6:30 PM
ParameterLabs found that a malicious public ChatGPT share could execute attacker-controlled JavaScript inside the signed-in chatgpt.com session of anyone who opened the link. The chain abused ChatGPT's HTML Preview crossing into the main page plus a MathLive postMessage listener, letting the payload enumerate conversations, read a private never-shared conversation, exfiltrate data, and call authenticated ChatGPT APIs as the victim. OpenAI fixed it on October 26, 2026 and classified the report as P1.
8.5
Hacker News
dev-community
30 Oct 2026, 7:05 PM
Kevin Beaumont's post alleges Anthropic was compromised and that the official Claude Code extension for VS Code and Cursor contains malware that installs a remote access Trojan on developer desktops. The linked Phorion advisory preview says it found a backdoor in the official Claude Code for VS Code extension bundle distributed on Open VSX that drops a persistent SSH backdoor across macOS, Linux, and Windows. The post and preview give no version numbers, infection timeline, or Anthropic response; the Hacker News thread drew 315 points and 79 comments.
8.5
Hacker News
dev-community
28 Oct 2026, 7:03 PM
A write-up reports that as of 28 October 2026, Apple's shipped developer tools on macOS — git, curl, python3 — still trust certificates issued under the compromised eMudhra roots, even though Apple was notified on 17 October. macOS 27.2, released 26 October, not only failed to fix it but reverted users' manual workarounds, while dozens of other projects, many volunteer-run, shipped fixes days earlier. The post includes reproduction commands: `git ls-remote https://git-emudhra.we-have-a-problem.com/check.git` lists a commit if you're vulnerable, and a `-c http.curloptResolve=github.com:443:15.235.19.186` demo clones a fake GitHub repo whose README starts with INTERCEPTED.
8.5
The Hacker News
security
26 Oct 2026, 3:49 PM
Wiz says a campaign it calls Gheist has used stolen GitHub tokens since September 15 to push branches named ci-sync- plus six random characters, plant Actions workflows that print repository secrets into logs, then download the logs and delete the runs. Wiz recovered more than 13,500 planted branches from more than 850 compromised accounts, with successful runs in private repositories and GitHub Enterprise Server; GitHub's suspicious-workflow approval guard stopped every public-repo run Wiz checked but does not cover private repos or GitHub Enterprise Server. Deleting the branch or run does not undo the exposure: Wiz says to rotate every secret the repository could read and revoke the token that pushed the branch.