Cursor CVE-2026-26268: Hidden Git hooks RCE via agents autonomous Git operations | Hacker News Reader