#jetbrains

15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers

Trong 8 tháng, 15 plugin giả mạo trợ lý lập trình AI trên JetBrains Marketplace đã đánh cắp khóa API của khoảng 70.000 nhà phát triển thông qua mã độc lấy thông tin đăng nhập. Các plugin này ngụy trang dưới dạng công cụ hỗ trợ DeepSeek và OpenAI, gửi dữ liệu qua HTTP không mã hóa đến máy chủ C2 ở Bắc Kinh. JetBrains đã gỡ bỏ các plugin và vô hiệu hóa tài khoản, nhưng máy chủ C2 vẫn hoạt động 3 ngày sau đó. Người dùng cần thu hồi, xoay khóa API, chặn IP 39.107.60.51, kiểm tra hóa đơn thanh toán và quét kho lưu trữ.

Lập trình viên nên đọc bài này để hiểu cách các plugin giả mạo trên JetBrains có thể trộm lấy các chìa khóa API quan trọng của mình, từ đó bảo vệ dữ liệu và API của mình khỏi các cuộc tấn công mới tương tự trong tương lai.

Codex is now the recommended agent in JetBrains IDEs

JetBrains has selected OpenAI's Codex as the default recommended coding agent in JetBrains IDEs, replacing the previous approach where users had to manually choose an agent. The decision was based on a structured evaluation using real-world software engineering tasks across Java (225 tasks), C# (38 tasks), and Python (90 tasks) ecosystems. Candidates were ranked on solve rate, cost per task, and end-to-end latency. After a close offline benchmark between Codex (GPT-5.4 mini with medium reasoning) and Junie (Gemini 3 Flash), an online A/B test with real users tipped the decision in Codex's favor based on activation, churn, and failure rate signals. Users can still switch to any other supported agent, including Junie, Claude Agent, or any ACP-compatible agent, at any time. The recommendation will be re-evaluated as models and benchmarks evolve.

SSH Connections Are Moving to JetBrains Daemon in the Toolbox App 3.6 EAP

JetBrains Toolbox App 3.6 EAP introduces a change where SSH connections to remote environments now use the JetBrains Daemon (jetbrainsd) by default. This shift makes jetbrainsd a shared background service for JetBrains tools, aiming to improve reliability and reduce dependency on Toolbox-App-specific implementation. Users experiencing issues can disable the new SSH client via settings or revert to the stable release, and are encouraged to file bug reports with logs attached.

Kotlin Toolchain 0.11: The Next Step for Amper

Amper 0.11.0 has been rebranded as the Kotlin Toolchain and graduated to Alpha status. The release introduces a unified kotlin CLI command for project creation, building, running, testing, and publishing. Key new features include JVM library publishing to Maven repositories and Maven Central (with automatic PGP signing, sources/javadoc JARs, and POM metadata), global CLI installation via SDKMAN!, C interop support via .def files, improved terminal UI with native progress indicators, and module-wide dependency resolution in the IDE. Plugin development gains new APIs including custom checks, custom commands, and a generated section for registering generated files. Several default dependency versions were also updated including Kotlin 2.3.21, Spring Boot 4.0.6, and Ktor 3.4.3. Existing Amper users must replace wrapper scripts and switch to the new IntelliJ IDEA plugin.

YouTrack Helpdesk Now Includes Customer Groups

YouTrack 2026.2 introduces customer groups in YouTrack Helpdesk, enabling B2B support teams to manage tickets by company or organization, apply different SLAs per customer, assign dedicated agents, and let multiple reporters from the same organization share and follow tickets. The release also brings Whiteboard auto-layout and widgets, redesigned Gantt charts with improved performance, simplified MCP setup for connecting AI tools to YouTrack (with real-world examples from Gurtam and Fullworks), new import options from ClickUp and Asana, TypeScript support for app development, and several new marketplace apps covering sprint planning, QA management, time tracking, and third-party integrations.