Phorion found a persistent SSH backdoor in versions 2.1.312 and 2.1.313 of the official Claude Code VS Code extension on the Cursor Marketplace. Cursor has removed both versions. Developers and teams who installed the extension should check their machines now, since the payload runs as soon as the extension loads.
Valve's Achievement Sets beta lets Steam games group achievements by base game, DLC and other sets. Steam refuses unlocks for DLC the account doesn't own or for archived sets, and one rejected item can fail an entire batch write. A C# developer maintaining an achievement manager explains the schema changes, the parsing code and the ownership-check fix.
Claude Code is an agent that reads a repository, plans changes, edits files and runs dotnet build and dotnet test until the code passes. Mehdi Mohseni's guide shows how a .NET team can set it up with a CLAUDE.md, a PostToolUse build hook, plan mode and permission guardrails. It is worth reading if you want the agent to check its own work.
Microsoft and Syncfusion are collaborating on Blazor through a free, MIT-licensed component toolkit, merged framework fixes, and setup tooling. The Syncfusion Toolkit for Blazor needs no license key and can be used commercially. For Blazor developers, the work affects component choice, project setup and the quality of ASP.NET Core fixes.
A developer shared a small WinForms utility that totals GitHub release download counts across all their projects and keeps history over time. It compiles from a single C# 5 file with the csc.exe bundled in Windows, without Visual Studio. The write-up is useful for anyone tracking download trends or hitting GitHub API rate limits and TLS issues on .NET Framework 4.
Metalama 2027.0 introduces call-site interceptors that rewrite selected method calls at build time, so a method from a NuGet package or the .NET libraries can be wrapped without touching its source. The post walks through a retry example built from a T# template, a hand-written audit redirect, and the scoping rules. The feature is in preview from 2027.0.4-preview.
CritterWatch 1.1 groups dead letters by the failure that produced them, merging matches across every monitored service and database into one row. An operator can replay, archive, restore or discard a whole group as a single tracked operation with a required reason. The release also exposes the same loop through MCP, so teams running Wolverine can handle incidents faster and check whether replayed messages failed again.
Amp can now boot a cloud Mac during a thread to build, test and run iOS and macOS apps. The feature, macOS Satellites, is in beta and billed hourly. For developers working on Apple platforms, it changes how an agent verifies its own changes.
Critter Stack's new Bobcat 1.0 turns ordinary C# tests into readable executable specifications. The author starts from an existing xUnit test, adds step helpers, then covers decision tables and set verification for collections. It is a practical walkthrough for .NET teams who want reviewable tests without a Gherkin layer.
Visual Studio Marketplace now offers Trusted Publishing, which lets VS Code and Visual Studio extensions be published from GitHub Actions or Azure Pipelines without a long-lived personal access token. Publishing uses federated identity instead, so there is no secret to store or rotate. Extension authors who automate releases should review the setup and migration steps.
GitHub Copilot Fusion is now generally available. Instead of picking a model per task, developers select Fusion and an effort level, and Copilot decides which models run and how they cooperate. Administrators can restrict which models Fusion may use and make it the default. It is available in VS Code, the GitHub Copilot app, Copilot CLI and JetBrains IDEs.
The GitHub Copilot app now offers Projects in public preview, a home for work that spans several repositories, sessions and non-code assets. Copilot can pull in Slack and Figma context and run multiple agents that return pull requests for review. A computer use preview on macOS and Windows lets it operate desktop apps that lack an API or MCP integration.