This week's developer news
The 7 that mattered most this week, each in one line.
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
TL;DRThe official Claude Code for VS Code extension version 2.1.313 on the Cursor Marketplace contained a malicious backdoor.
Read on phorion.io →PHP Patches Two Critical RCE Flaws That Were Already Under Attack
TL;DRPHP released emergency versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to patch two critical remote code execution vulnerabilities under active exploitation.
Read on infoq.com →Node.js 26.13.0 (LTS)
TL;DRNode.js version 26.13.0 has transitioned into Long Term Support under the codename Lithium.
Read on nodejs.org →The result of the C++26 DIS ballot
TL;DRThe C++26 draft failed its ISO DIS ballot for the first time, primarily due to opposition against the new contracts feature.
Read on train-it.eu →What to check before upgrading the Anthropic SDK
TL;DRAnthropic released API version 2026-10-21 alongside Python SDK 2.0.0 and TypeScript SDK 1.0.0, introducing breaking changes to request contracts and authentication headers.
Read on flaviocopes.com →Gems of DuckDB 2.0.0
TL;DRDuckDB 2.0.0 introduces a Python appender for buffered row inserts, a new .manual CLI command, and command history querying.
Read on duckdb.org →Microsoft Retires Azure Deployment Environments with No Replacement Product
TL;DRMicrosoft is retiring Azure Deployment Environments on February 22, 2027, and Microsoft Dev Box on September 18, 2028, without direct product replacements.
Read on infoq.com →Your stack, every morning
Pick your languages and tools. Code News sends a Daily brief at 9:00 and a Past week recap, with a TL;DR on every article.
Code News by CodeBldr · picked from 240+ developer sources · tap a story to read it on the original site