May was a big month. Too big, arguably. Let me just talk about the things I actually care about.

Update Cursor. Do It Now.

I’ll lead with this because it’s the most urgent thing in the notes: CVE-2026-26268, rated 9.9 critical by NVD, affected Cursor versions prior to 2.5. The attack surface is uncomfortable to think about. Clone a malicious repository, let the AI agent start doing its autonomous Git thing, and you’ve potentially handed an attacker code execution on your machine.