The SDK Maintainer Called It Expected Behavior, but the CVE Trail Says Otherwise (opens in new tab)

Covers 5 stories including Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files | CVE-2025-59536

Amazon patched a flaw in Amazon Q Developer this week that let a malicious workspace execute commands after a developer opened and trusted it, exposing the d...

Read the original article