Attackers can abuse VS Code configuration files for RCE when a GitHub Codespaces user opens a repository or pull request.
The justice department says its review of the files is over, but the story is again proving to have a life of its own.