The zero-day that could've compromised every Cursor and Windsurf user