A zero-day is a security flaw that the software company doesn't know about and hasn't fixed yet. The name means developers have "zero days" to prepare a fix before attackers can exploit it.
Think of it like discovering a hidden door in your house that you didn't know existed — and someone else already knows where it is. Until you can lock that door (install a patch), your home is vulnerable.
In this case, the hidden door is in VS Code, a free code editor made by Microsoft that millions of developers use every day. The flaw lets attackers steal GitHub tokens — think of tokens as digital keys that let software programs access your online accounts automatically.
If you've ever used a "Sign in with Google" button, you've used a token. Tokens are different from passwords in important ways:
| Feature | Password | Token |
|---|---|---|
| What it is | A secret word you type | A digital code your computer sends |
| Who uses it | You (a human) | Software programs |
| What happens if stolen | You can change your password | Harder to detect — programs don't "notice" they're stolen |
| Expires | Never (unless you change it) | Usually lasts hours or days |
| Access level | One account | Can have wide access to everything |
Key point: The GitHub tokens stolen in this zero-day attack have full access to all the code repositories the developer can access — not just the one they were editing. That's a much bigger problem than a stolen password, which would only let someone log into one account.
Most security bugs we hear about involve hackers finding a weak password or tricking someone into downloading malware. This one is different:
Think of it like this: you hand your house key to a doorman at a building you're visiting. The doorman is supposed to only use the key for you. But instead, he makes a copy and gives it to a stranger who can now enter your house whenever they want — and you don't even know a copy exists.
This vulnerability affects anyone who uses github.dev — the browser-based version of VS Code. According to data from GitHub, that's potentially millions of developers worldwide. Even if you're not a developer, you should care because the Miasma supply chain attack disclosed this week (June 1, 2026) showed how attackers can use a single stolen developer credential to infect software packages used by millions. When you need a password immediately, the Instant Password Generator quick tool generates one with zero load time.
What is VS Code and do I use it?
VS Code (Visual Studio Code) is a free code editor made by Microsoft. If you're not a developer, you probably don't use it — but the developers who build the apps you use every day definitely do.
Does this affect regular (non-developer) users?
Not directly. However, if a developer you work with is compromised, and they have access to code that powers an app you use, that app could be affected indirectly through a supply chain attack.
How is a token different from a password?
A password is something you type yourself. A token is a digital code that your computer sends automatically. The problem with stolen tokens is that you might not realize they've been taken.
Is Microsoft going to fix this?
Microsoft has not yet commented or released a patch. The researcher chose public disclosure citing a previous bad experience with Microsoft's security team. In the meantime, clear github.dev cookies as a temporary measure.
What's the single most important thing I can do?
If you're a developer: clear your github.dev cookies right now. If you're not: help the developers in your life understand this risk. Use strong, unique passwords everywhere and enable 2FA.
Affiliate Disclosure: This post may contain affiliate links. If you purchase through these links, we may earn a small commission at no extra cost to you. FreeStrongPassword.com is free to use. Full disclosure.