Microsoft's July release adds a Copilot Chat agent preview, workload-specific skills, shared instructions, branch context and C++ build controls.

Microsoft's latest weekly VS Code release advances shared agent sessions, multi-file change review, chat visibility and terminal navigation ...

Visual Studio Code 1.130 adds a dedicated agent host, assisted permissions, compact diffs, worktree isolation, and smarter Git links.

A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems ...

Open VSX extensions exposed developer supply-chain risks. Learn how to audit VS Code extensions and reduce credential exposure.

More than 400 NPM packages have been infected with the Mini Shai-Hulud worm in the ChainDrop supply chain attack.

Open VSX removes 77 evil twin extensions that impersonate developer tools and exfiltrate host, workspace, Git, and CI data.

A trojanized QuickFox Windows installer delivered FDMTP in a supply chain attack active since at least August 2025, after ...

A hijacked GitHub account let the Shai-Hulud worm pass npm's trust check, spreading through packages with 2 billion monthly ...

A massive supply chain attack on the Node Package Manager (npm) registry has infected over 400 packages with over 2 billion downloads with the ...

Editors: Several photos to go with the following story may be found in today’s folder. See cutline information below.

Microsoft's August Patch Tuesday release is smaller than July's record-breaking update, but only by the standards of what has quickly become a new era of massive monthly security drops.