Amazon Q vulnerability could allow attackers to steal developer cloud credentials by luring them into opening a booby-trapped ...

A flaw in Amazon Q Developer auto-loaded rogue MCP servers from cloned repos, letting attackers steal AWS credentials silently. A high-severity flaw in Amazon Q Developer allowed a malicious code ...

Lazarus Group concealed a four-module remote access toolkit inside six fake npm Rollup polyfill packages that fired at import ...

Overview Windsurf and Amazon Q Developer, two familiar AI coding brands, will have each moved into different product areas by ...

CVE-2026-12957 in Amazon Q is the third MCP auto-execution vulnerability in three AI coding tools. The pattern reveals a ...

Hackers created a fake trading bot for Polymarket’s prediction markets on GitHub. The bot was used to spread malware that ...

AI compressed the build. Fundamentals matter more, not less, and the product funnel is now where engineers earn their keep.

The Microsoft store on Fifth Avenue in Midtown Manhattan is shown June 4, 2018 in New York City. Microsoft officially announced today an agreement to buy GitHub, a code repository company popular with ...

Decades-old Bash shell tricks can bypass safeguards in most open source AI coding agents, creating a new software supply ...

Mozilla 0DIN’s Claude Code demo shows how clean GitHub repos can expose AI coding agents to prompt injection, reverse shells, ...

Qodo, the AI code quality and governance platform trusted by Walmart, NVIDIA, Red Hat, and Monday.com, today announced three new platform capabilities: Cross-Repo Code Review, Custom Rules Miner, and ...

JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.