Cursor CVE-2026-26268: Hidden Git hooks RCE via agents autonomous Git operations | Heykuki News