Claude Code's Cursor extension was backdoored

Plus: Northflank says rotate every secret, and Vercel starts billing for Data Cache.

The main thing

If you installed or updated Claude Code from Cursor's extension marketplace on October 29, check the version now. A malicious extension could run code on your machine, beside your source code and credentials.

Cursor's security notice identifies Anthropic.claude-code versions 2.1.312 and 2.1.313 on macOS and Windows, available from about 2:27am to 1:35pm Pacific that day. The modified extension tried to add an attacker SSH key, enable SSH, and install a persistent reverse tunnel. Cursor says enabling the local SSH service would fail on most hosts without administrator privileges, but the extension could still leave a key and persistence scripts behind and send host details to the attacker.

Cursor removed the malicious versions, blocked further distribution, and took the attacker server offline. It says it has no evidence that other extension versions or the official distribution were affected. Ars Technica reports that attackers accessed Anthropic's verified Cursor publisher account; how they did so remains unknown.

What to do today: If you installed either version from Cursor's marketplace during that window, follow Cursor's checks and removal steps. Search for its indicators, isolate hosts showing payload execution, and remove the SSH key, persistence scripts, and tunnel processes. Decide whether to rebuild the host. Then rotate credentials and sessions from a trusted system. Uninstalling the extension alone may leave the persistence scripts running.

Quick bits

• Google Cloud spend caps are GA. The caps can stop eligible requests when a monthly spend limit is reached. Your sandbox's runaway agent finally has a bedtime.
• Vercel is moving Data Cache into Runtime Cache. Next.js fetch caching and unstable_cache switch without code changes, but once migrated, unbilled reads and writes cost from $0.40 and $4.00 per million units. Hobby teams move November 29, 2026.
• OpenAI, Google, Microsoft and Anthropic back a shared robots.txt signal. Sites state AI training preferences once for participating providers. The signal covers AI training for participating providers.
• eMudhra's weak keys, one literally the number 4, are being tried. Cloudflare saw about 22,000 handshakes in a week, mostly tests, and no evidence that its own connections were intercepted; targeted interception remains possible. Unpatched clients that don't enforce Certificate Transparency accept forged certificates, so patch them.
• Northflank says assume every environment variable was decrypted. All customers should revoke and rotate secrets in workloads, secret groups and global secrets, and disable public access on addons. Users report unauthorised use of their AI API keys, so check provider billing logs.
• Researchers describe five Azure cross-tenant compromises. Check the research for affected services and remediation.
• Cloudflare services for private origins are GA. Point a proxied A or AAAA record at a private IP; Cloudflare routes to the origin over your private connection while WAF, caching, bot management and Workers stay on its network. You'll need the Private Origins entitlement from your account team.
• DoorDash cut grocery reorder latency from about 16 seconds to 2 by precomputing recurring purchases with batch LLM inference and deterministic validation. Shopping list views doubled. Turns out the fastest model call is the one you already made.

Also happening

• Linode is mitigating CVE-2026-98432: no evidence of exploitation on its platform; apply upstream OS updates to your workloads when they land.
• Bunny CDN reported a provider breach on October 28: neither investigation found access, but Bunny could not rule it out. It began reissuing managed certificates; if you manage your own, revoke and reissue with new keys.
• Canonical LXD gets a CVSS 10 in CVE-2026-112816: check the advisory for affected releases and fixes if you run it.
• @nx/maven and @nx/gradle allow shell injection via nx.json: @nx/maven 22.0.2 up to, not including, 22.7.9, @nx/gradle 21.0.0 up to, not including, 22.7.9, and both 23.0.0 up to, not including, 23.1.2, when running nx on a hostile repo or PR; upgrade nx too, with @nx/maven@22.7.9, @nx/gradle@22.7.9, @nx/maven@23.1.2 or @nx/gradle@23.1.2.
• joi's multiple-email validation allows DoS: 17.1.1 up to, not including, 17.13.9 and 18.0.0 up to, not including, 18.3.1, on untrusted input with no length limit; upgrade to joi@17.13.9 or joi@18.3.1; @hapi/joi from 16.0.0 has no fix, so add .max() before .email() and do not use abortEarly: false with that schema.
• @hapi/content multipart parsing allows DoS: every release through 6.0.2, on routes accepting multipart; upgrade to @hapi/content@6.0.3; content 3.0.6 through 4.0.6 has no fix, so migrate off it.
• @sigstore/oci sends registry credentials to cross-host upload Locations: versions through 0.7.1, when a registry is malicious or compromised; upgrade to @sigstore/oci@0.7.2.
• OAuthLib can authorize grants against the wrong client: versions before 4.0.0, if your validator authorizes by the client_id argument; upgrade to oauthlib==4.0.0.
• Authlib's RFC 7592 examples skip token-to-client binding: 0.15 through 1.9.0, if you built your endpoint from them; upgrade to Authlib==1.9.1 and confirm your subclass checks the token belongs to the client.
• GraphQL-core leaks memory on aborted validations: 3.3.0a3 up to, not including, 3.3.1, triggered by a document exceeding max_errors; upgrade to graphql-core==3.3.1.
• Applebee's left a database password in its Android app: customer data was reachable; now fixed.
• TRM Labs and Elliptic blame North Korea for the $6.3B Binance theft: Binance traces it to a compromised engineer's laptop.
• Polymarket halted trading after a vendor compromise: NBC's source names DebugBear; Polymarket promises reimbursement.
• GitHub Actions, Pages and Webhooks degraded: resolved October 30 at 19:23 UTC, root cause analysis to come.
• GitHub Dependabot alerts threw errors: resolved October 30 at 23:29 UTC.
• SageMaker AI inference adds GPU partitioning: up to seven isolated partitions per GPU, so small models can share one.

Patch roundup

• pypa/gh-action-pypi-publish: upgrade to 1.14.3
• imgproxy: for v4, upgrade to the current v4.0.18 release, which includes the ICO loader fixes.
• Ivanti Connect Secure: CISA added CVE-2026-118527 and CVE-2026-111357 to its known exploited list; check vendor remediation.
• node-forge: node-forge@1.4.1
• pypdf: pypdf==6.21.4
• follow-redirects: follow-redirects@1.16.2

Happy Halloween. The scariest costume this year is a verified publisher badge.

← All issues