VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks
2026-06-08T07:24:08Z•d080a14804582c469fd5981dea457744ad14b0a9d64aeaa2894d145d7c765753
active-exploitationagentic-aicloud-compromisedosffmpeg-zero-daysgithubmalvertisingmitigationnpmphishingrceself-spreading-wormsmtp-relayspywaressrfsupply-chainvulnerabilitieswordpress
What happened
A wave of high-impact security developments: multiple active exploitations and supply‑chain campaigns (Miasma, IronWorm) have hit popular developer ecosystems (GitHub, npm) and vendor repositories, while researchers and vendors disclosed numerous critical vulnerabilities and zero-days. Notable confirmed CVEs include a CISA-listed SolarWinds Serv‑U DoS (CVE-2026-28318), an actively exploited Cisco Catalyst SD‑WAN Manager flaw (CVE-2026-20245), a critical Everest Forms Pro RCE (CVE-2026-3300, CVSS 9.8) and a Cisco Unified CM SSRF leading to local privilege escalation (CVE-2026-20230). Autonomous
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- d080a14804582c469fd5981dea457744ad14b0a9d64aeaa2894d145d7c765753
- Enrichment time
- 2026-06-08T07:24:08Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.