Up to 5,000 developers were exposed to an SSH backdoor loader in v2.1.313, CISA sets a Sunday deadline for GitLab CVE-2026-97229 across 2,800 exposed CE servers, and DOJ prosecutes North Korean and Syrian cyber actors.
By Lazy Tensor4 min read
Cursor removed a trojanized Claude Code extension (v2.1.313) after an 11-hour window that exposed up to 5,000 developers, while CISA confirmed active exploitation of GitLab flaw CVE-2026-97229 and Trezor warned of a suspected Safe 5 hardware implant.