Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks

March 27, 2026
No Comments

Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks

Cybersecurity researchers have disclosed details of a now-patched bug impacting Open VSX’s pre-publish scanning pipeline to cause the tool to allow a malicious Microsoft Visual Studio Code (VS Code) extension to pass the vetting process and go live in the registry.
“The pipeline had a single boolean return value that meant both ‘no scanners are configured’ and ‘all scanners failed to run,'” Koi

Leave a Reply Cancel reply

Expert panel: Cyber conflict in a fractured world March 26, 2026
No longer are geopolitical standoffs settled on the traditional battlefields of diplomacy and arms; now, the digital realm has emerged as the arena for these conflicts. In this article, we bring together industry experts to discuss the dynamics of the development of cyber threats during unstable international circumstances, the role of automation and AI in the realm […]
Kirsten Doyle
FCC Blocks Foreign-Made Routers, Citing National Security Risks March 26, 2026
The US Federal Communications Commission (FCC) has announced a plan to prevent the authorization and import of new consumer routers produced outside the US, adding them to its “Covered List” of items that pose a national security risk. This decision is a result of a government assessment that found routers produced abroad pose a critical cybersecurity and […]
Kirsten Doyle
Cloud Security Controls Explained: A Definitive Guide March 19, 2026
Most teams already have cloud security tools in place. That’s not the issue. The problem is that those tools don’t give you any real control. Infrastructure is built fast, modified constantly, and touched by too many people to track. Code moves through CI pipelines and ends up in production before anyone from security even knows […]
Tyler Carrigan
New Ubuntu Snap Bug Opens Door to Delayed Root Compromise March 19, 2026
A newly disclosed flaw in Ubuntu’s Snap ecosystem is raising fresh concerns about local privilege escalation risks in default Linux environments. Researchers at Qualys have identified CVE-2026-3888, a high-severity vulnerability that allows a low-privileged local user to escalate access to full root control on affected systems. The problem affects default installs of Ubuntu Desktop versions 24.04 and […]
Kirsten Doyle
Delegated Trust Is Becoming the Largest Attack Surface in Modern Security March 18, 2026
Over the next decade, the way we define security failures is going to change. No longer will it begin with an unpatched server or a careless employee clicking the wrong link. The root cause will be something far more ordinary, yet harder to see: third-party services. Right now, organizations are allowing outside services to sit […]
Clarence Chio
UK’s Companies House exposed data linked to millions of firms March 18, 2026
Companies House, the UK’s official registrar of companies, has disclosed a security flaw in its WebFiling service that exposed sensitive data tied to more than five million registered businesses. The issue traces back to a system update rolled out in October 2025 and went unnoticed for five months before it was flagged. The vulnerability meant logged-in users could access other companies’ records simply […]
Kirsten Doyle
Cyberattacks Soar 245% as War Triggers Global Digital Offensive March 18, 2026
Since the outbreak of the Middle East conflict on 28 February 2026, Akamai has seen a surge of 245% in cyberattacks against key businesses and institutions in North America, Europe, and some Asian Pacific countries. One group in particular, Handala (widely believed to have ties to Iranian intelligence) has claimed responsibility for a destructive data-wiping attack on Stryker, the global […]
Kirsten Doyle
‘CrackArmor’ Exposes Nine Vulnerabilities in Linux AppArmor March 18, 2026
The Qualys Threat Research Unit (TRU) has identified nine vulnerabilities in AppArmor, a Linux Security Module. The vulnerability has been present since 2017 (version v4.11). AppArmor is the default mandatory access control system for Ubuntu, Debian, SUSE, and several cloud platforms. Its presence in all these systems and its use in all these platforms make the threat landscape much wider. […]
Kirsten Doyle
ShinyHunters Claims It Stole 1PB of Data from TELUS Digital March 17, 2026
TELUS Digital has fallen victim to a security incident in which unsanctioned actors accessed its systems. Upon learning of this incident, the company said it took immediate action to resolve it and prevent any future breaches of its systems and environment. “All business operations within TELUS Digital remain fully operational, and there is no evidence of […]
Kirsten Doyle
Why OSINT deserves the same status as other intelligence disciplines March 17, 2026
Open source intelligence (OSINT) still sits outside the intelligence mainstream. If you’re not acquainted with the intelligence profession, you might not have come across the term at all. OSINT is the targeted collection and analysis of publicly available or licensable data to generate actionable intelligence. The discipline is a critical tool for combating crime and […]
Chris P.

Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks

Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks

Share :

Leave a Reply Cancel reply