“Black October” ended the way it started: with attacks on the tools developers install. This week the target moved from packages to the editor itself. Here is what matters if you write and ship software, most urgent first.
The same note on sources as last week: much of this coverage comes from security vendors and weekly digests rather than the affected companies. Every item links to where it was reported. Before you act on a version number or a deadline, check the vendor’s advisory or CISA’s catalog.
Supply chain: the one developers should read first
A backdoored Claude Code extension on Cursor’s marketplace (29–30 October)
Versions 2.1.312 and 2.1.313 of the Claude Code extension on the Cursor Marketplace carried a backdoor. Reports put it there for about half a day before Cursor took both versions down. How the attackers got publishing access had not been explained at the time of writing. (Phorion, Cursor’s notice)
The malicious code ran as soon as the editor loaded the extension, with no click needed. According to Phorion’s analysis, it:
- added an attacker’s SSH key (comment
svc-telemetry) to~/.ssh/authorized_keys; - opened a reverse SSH tunnel to
134.209.82[.]225and kept retrying it; - installed persistence, on macOS as
~/Library/LaunchAgents/com.apple.sysmond.plistrunning~/.config/.smt, with Linux and Windows variants; - sent the hostname, user name, git email and the names of environment variables that look like secrets (
KEY,TOKEN,AWSand so on) to the same server.
Uninstalling the extension does not remove the backdoor. If either version was installed, follow Phorion’s cleanup: kill the shell loop and any ssh to that address, delete the LaunchAgent and ~/.config/.smt*, remove the svc-telemetry key, and check that Remote Login is off. Then rotate every credential that user account could reach.
106 malicious packages in three days
Between 26 and 28 October, GitHub’s advisory database flagged 96 npm and 10 PyPI packages as malware (Safeguard). Most were the usual crypto miners and dependency-confusion beacons. Three behaviours stood out:
- Writing to AI assistant config. One loader (
@testsecuiitytestme/cache-helper) checked whether it was in CI or a sandbox, and if not, collected credentials and wrote into.claude/settings.jsonhooks,.cursorrules,.mcp.jsonandCLAUDE.md. A package that rewrites your agent’s instructions can keep running after it is removed. - Publishing as you.
publish-poc-test3used the installer’s own npm login to publish new packages. Check your npm account for packages namedpublish-poc-found-…that you didn’t make. - Borrowed AI brand names. PyPI packages named
claudeopusfileand similar were info-stealers that looked up their command server from blockchain transactions. Nothing connects them to Anthropic.
Safeguard says uploads may predate the advisories, so search install logs from 23 October onward.
A third-party script drained Polymarket wallets (29 October)
Attackers got into a script Polymarket loaded from a performance-monitoring vendor (DebugBear) and used it to drain about $2.6 million from 726 wallets, which Polymarket says it will refund (Senthorus, this week in security). Every third-party <script> on a page that handles money or logins runs with that page’s full access.
Exploited right now: patch these first
These are on CISA’s Known Exploited Vulnerabilities list or reported as exploited, which means attackers are already using them.
| Product | CVE | What it is | Status |
|---|---|---|---|
| PHP (“PHP2Shell”) | CVE-2026-109618, CVE-2026-109619 | Memory corruption and stale request state in the interpreter | Added 26 October, federal deadline 29 October. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (tracker). |
| Ivanti Connect Secure | CVE-2026-111357, CVE-2026-118527 | Chained with last week’s CVE-2026-104935 to run commands as root without logging in | Added 30 October. Affects 25.1.1.2, 25.1.2.2, 22.8R2.5 and earlier (this week in security). |
| Cisco Secure Firewall ASA and FTD | CVE-2026-76418 | Remote access VPN bug that reloads the firewall, no login needed (CVSS 8.6) | Added 29 October. No workaround short of removing secondary authentication (Neoteo, Cisco). |
| GitLab | Maximum-severity bug | Unauthenticated code execution | CISA reported exploitation on 30 October. Alpine Linux saw attempts and rebuilt its GitLab server (Senthorus). Update self-managed GitLab to the latest patch release. |
| Oracle E-Business Suite 12.2.3–12.2.15 | CVE-2026-101767 | SQL injection that leads to code execution, CVSS 9.8 | Probing seen from 27 October, with 670+ instances exposed. Fixed in Oracle’s October patch update (SecurityWeek). |
| Drupal Commerce | SA-CONTRIB-2026-254 | Access bypass | Exploited (Drupal). |
Critical bugs to patch
-
Brotli (“Node2Shell”) is still spreading (CVE-2026-111497, SecurityWeek, 26 October). Last week’s Brotli decoder bug now has fixes from:
- Microsoft: .NET 8.0.33, 9.0.22 and 10.0.14, .NET 11 RC3, Visual Studio and PowerShell 7.4–7.6;
- Python:
brotli1.2.1 andbrotlicffi1.2.1.0.
DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II were still listed as unpatched. Imperva showed code execution on the official Node.js 24.22.0 arm64 image, but no attacks have been reported yet. Updating the library is not enough on its own: restart services and rebuild container images on patched base images.
-
Tailscale SSH (“Tailworm”) (SecurityWeek, 27 October). Researchers published 11 findings against Tailscale 1.104.2 and headscale 0.29.5 before the fixes shipped. Four of them are in Tailscale SSH, and in a lab they gave root on target servers and could hop from one server to the next. Update clients (fixes are reported in 1.104.4), and see Tailscale’s bulletins. Until then, turn off SSH forwarding where you don’t need it.
-
Canonical LXD and MicroCloud (CVE-2026-112816, Ubuntu, 28 October). Anyone holding a trusted client’s public certificate could log in as that client, which can mean root on the host. Fixed in LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, and MicroCloud 3.4.1 and 2.1.5. Run
sudo snap refresh lxd microcloud. -
Linux kernel TCP (CVE-2026-98432, CVSS 9.8). A use-after-free race in the kernel’s IPv4 TCP handshake code. Anthropic says an internal Claude model built a working remote root exploit against a server with a Multipath TCP (MPTCP) listener. The exploit isn’t public and nobody had reproduced it independently by 30 October. The bug itself is in IPv4 TCP, so it isn’t limited to MPTCP. No attacks have been reported, and it isn’t on CISA’s list. Debian, Oracle UEK and Amazon Linux are reported fixed. Red Hat and Ubuntu had not shipped a fixed kernel at the time of writing (TuxCare, pwn.watch, PatchMon). Install the fixed kernel as soon as your distribution has one, then reboot: until you do, the old kernel is still the one running.
-
Also patched this week (SecurityWeek):
- Veeam: critical bugs in Backup & Replication, CDP and Backup for Microsoft 365 (KB4948);
- Juniper: two critical command-execution bugs in Session Smart Router;
- Adobe: Campaign Classic and Connect;
- Firefox 159 (MFSA 2026-118).
AI coding agents: the built-in browser is the new way in
Forever Security found bugs in the browsers built into five AI coding tools. A page opened in that browser could reach things a web page never should (The Register, 29 October):
| Tool | What a web page could do | Status |
|---|---|---|
| Cursor | Send hidden instructions to the agent, which then ran commands | Fixed quietly on 1 October, with no advisory |
| GitHub Copilot | Fake the address bar | Fixed in 1.1.29 |
| Claude Desktop | Read files outside the project | Not stated |
| OpenAI Codex | Read any file | Unpatched. OpenAI says it is working on it. |
| VS Code | Steal data | Unpatched, per the researchers. Microsoft called it a workspace-trust issue. |
Put this next to the extension backdoor and the packages that rewrite CLAUDE.md, and the picture from last week holds. The attacks don’t need an exploit in the agent. They need an agent that reads something it shouldn’t trust and then acts with the developer’s permissions. Until vendors close these, treat the agent’s built-in browser like any other browser: don’t point it at pages you wouldn’t trust with your files. Run agents in a sandbox that limits which files they can read, which addresses they can reach and which credentials they can see.
Ransomware and breaches
- Binance lost about $6.3 billion around 29 October. The FBI blames North Korea’s TraderTraitor group and says the way in was a compromised engineer’s laptop (FBI). Developer machines are where production keys live.
- Applebee’s exposed customer data after leaving a database password inside its app (TechCrunch, 30 October). Anything shipped in a client binary is public.
- Sony Network Communications (So-net, plala) disclosed 2.58 million exposed records, including credentials for 54,401 email accounts (BankInfoSecurity).
- US Department of Homeland Security: a hacker took contact details for more than 40,000 staff from an Okta-backed system (TechCrunch).
- Florida Department of Education: about 4.9 million people’s records, including Social Security numbers, from the student financial aid portal (FLDOE).
- Hosting providers:
- GMO Internet said hackers posted customer data, with up to 26,000 servers possibly affected (TechCrunch);
- 123-Reg disclosed an “AI-driven” scrape of customer contact data (The Register);
- DreamHost reset email, FTP and SFTP passwords after an incident (status page).
- Chainalysis confirmed an intrusion that reached customer names, emails and roles (The Hacker News).
This week’s checklist
- Check every Cursor install for the Claude Code extension at 2.1.312 or 2.1.313. If you find either, clean up the backdoor by hand and rotate that user’s credentials. Uninstalling is not enough.
- Search lockfiles and install logs from 23 October onward against GitHub’s malware advisories. Look for unexpected changes to
CLAUDE.md,.mcp.jsonand.claude/settings.jsonin your repos and home folder. - Patch PHP, and anything internet-facing from Ivanti, Cisco ASA/FTD, GitLab or Oracle EBS.
- Rebuild container images with fixed Brotli, .NET and Node.js, then restart the services.
- Update Tailscale clients and LXD. Install your distribution’s fix for the Linux kernel TCP bug (CVE-2026-98432) when it ships, and reboot.
- Don’t open untrusted pages in your coding agent’s built-in browser, and keep the agent sandboxed.