NewsThe Hacker News
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
More on Installing
Other advisories
- Not ratedosv:CLEANSTART-2026-FW80348pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels
- Not ratedosv:CLEANSTART-2026-JD93552When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory
- HighCVE-2026-95521Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm
- Not ratedosv:CLEANSTART-2026-PH11243pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels
- Not ratedosv:CLEANSTART-2026-RT26999pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels
- MediumCVE-2026-105163Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
- Not ratedosv:CVE-2026-74285net: Stop leased rxq before uninstalling its memory provider
- Not ratedosv:GO-2026-5709Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag in github.com/crossplane/crossplane
Other news entries
- AI coding agents hijacked using AGENTS.md file in Downloads folderNewsBleepingComputer
- Windows Server 2025 gets support for quick machine recoveryNewsBleepingComputer
- Microsoft fixes game, app crashes caused by recent Windows updateNewsBleepingComputer
- Microsoft: October Windows update may break Smart App ControlNewsBleepingComputer
- Microsoft fixes bug causing Windows black screens, Explorer crashesNewsBleepingComputer
- Microsoft fixes VPN issues caused by September Windows updatesNewsBleepingComputer
- Microsoft: Recent Windows updates may trigger Remote Desktop failuresNewsBleepingComputer
- Microsoft: Windows KB5124010 update crashes some games and appsNewsBleepingComputer
Source: https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html
ID