VS Code flaw exposes GitHub OAuth tokens via one-click attack on GitHub.dev, enabling private repo access and token theft.

IT之家 6 月 3 日消息，安全研究员 Ammar Askar 昨日（6 月 2 日）发布推文，公开了一个概念验证（PoC）漏洞，指出 GitHub 浏览器版 VS Code 存在安全漏洞，用户点击链接后，GitHub OAuth tokens 可能被黑客掌握。 IT之家援引博文介绍，该漏洞受存在于 GitHub 浏览器版 VS Code（github.dev）的 Webview 机制中。Web ...

Yet another aggrieved bug hunter has leaked a vulnerability affecting a Microsoft product after becoming disillusioned with ...

A VS Code vulnerability in GitHub.dev lets attackers steal full GitHub OAuth tokens via a single malicious link, exposing all private repositories.

近日，安全研究员 Ammar Askar 公开了一条利用 VSCode 漏洞一键窃取 GitHub Token 的完整攻击链。攻击者无需密码、无需下载恶意程序，只要诱导用户打开一个特制链接，就有机会获取 GitHub ...

Days after IBM and Red Hat announced a master security plan for open-source software, Red Hat suffers a major breach of its ...

Perplexity launches Bumblebee: How its new read-only dev scanner differs from Chainguard ...

Anthropic releases Claude Opus 4.8 with dynamic workflows, 1,000 parallel subagents, and 3x cheaper fast mode. Here's what ...

Troy baseball has been around since 1911. That’s 115 years. Yet, the Trojans hold a chance to do something Monday they’ve ...

文丨李海伦编辑丨徐青阳美国时间6月2日，微软Build 2026开发者大会在旧金山梅森堡拉开帷幕。此次大会主题聚焦于前沿AI技术的实战应用，微软发布了一系列覆盖自研AI模型、智能体应用、操作系统安全、开发者工具、云服务及新型硬件平台的产品与更新。