Digest · Wednesday

Security digest: July 23, 2025

1 editorial brief.

All digests · RSS · Markdown

Take stock

Most can relax: Amazon Q VS Code Extension 1.84.0 Shipped a Wiper Prompt. Anyone who still has Amazon Q Developer for VS Code 1.84.0 installed, mirrored in an internal marketplace, or baked into a dev container image.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Most can relax

Jul 23, 2025 · Supply-chain compromise · CVE-2025-8217

Amazon Q VS Code Extension 1.84.0 Shipped a Wiper Prompt

A real supply-chain compromise with a payload that AWS says could not run; if nothing in your fleet still has 1.84.0, there is nothing left to do.

Must act: Anyone who still has Amazon Q Developer for VS Code 1.84.0 installed, mirrored in an internal marketplace, or baked into a dev container image.

Can relax: Everyone on 1.85.0 or later, which is anyone whose VS Code auto-updated extensions after July 24, 2025.

List installed versions with `code --list-extensions --show-versions | grep -i amazon` on every developer machine and image.
Remove any copy of 1.84.0 and update to the current release (1.85.0 or later).
Purge 1.84.0 from internal extension mirrors, offline VSIX caches and dev container images.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.