Your weekly cybersecurity recap: a GitHub supply chain worm, an exploited Android flaw, Instagram account takeovers, and a ...

VS Code flaw exposes GitHub OAuth tokens via one-click attack on GitHub.dev, enabling private repo access and token theft.

Fake Claude Code installer malware used Google Ads to place spoofed AI tool pages above real documentation since March 2026.

Good UX hides its waste. But it doesn't disappear – it ends up in data centers, supply chains, and telemetry databases.