Firehose

A backdoor in the Claude Code extension for VS Code has been discovered, allowing attackers to establish persistent SSH access on macOS, Linux, and Windows. The extension's persistence mechanism relies on a user-launch agent, making it difficult to detect. Remediation involves uninstalling the extension, killing active tunnel processes, removing persistence, and rotating credentials. Phorion's detection coverage flags the macOS persistence and provides visibility into the attack chain. AI summary

Cloudflare has identified a cross-request KV cache exposure issue in the GLM-5.3 Workers AI model, which affected 155 responses to prompts longer than 681,280 tokens. The issue was caused by a misconfiguration of the SGLang inference engine, which resulted in the model generating responses that contained data from other customers' requests. The bug was patched, and the model has been restored with a corrected configuration and patched inference engine. AI summary