Oct 31, 2026 · 12:19 UTC
The point
Cursor says a tampered Claude Code extension 2.1.313 tried to install a persistent SSH backdoor and impacted around 5,000 developer systems. Anthropic says a malicious actor used Cursor marketplace access to publish it.
Why it matters
Builders who used that extension in Cursor should hunt for the backdoor, not just update.
Key details
- Code collected hostname, username, OS, architecture, home directory, Git email, and public IP
- It tried to add an attacker SSH key and open a reverse tunnel
- Version 2.1.314 replaced 2.1.313, but updating does not remove the backdoor from infected systems
Oct 30, 2026 · 22:19 UTC
The point
Phorion found a persistent SSH backdoor in the official Claude Code for VS Code extension 2.1.313 on the Cursor Marketplace. Cursor removed that release. The malware adds an attacker key, opens a reverse tunnel, and installs persistence across macOS, Linux, and Windows.
Why it matters
Builders on 2.1.313 need incident response and full cleanup, not just an update.
Key details
- Planted key comment is svc-telemetry in ~/.ssh/authorized_keys
- Persistence includes macOS LaunchAgent com.apple.sysmond.plist and Linux @reboot cron
- Phorion says uninstalling alone will not remove the backdoor
Oct 30, 2026 · 20:18 UTC
The point
Security researcher Kevin Beaumont reports that Claude Code extension version 2.1.313 contained malware creating a reverse SSH backdoor to desktops. He says that version was removed, 2.1.314 is the fixed version, and auto updates widened impact.
Why it matters
Builders should check installed versions and remediate impacted VS Code and Cursor systems manually.
Key details
- C2 collected hostname, username, OS, architecture, home directory, environment variable names, and Git email
- Reverse SSH let the attacker choose victims for hands on keyboard access
- Beaumont says updating alone does not remove prior backdoors or recon activity
Oct 29, 2026 · 13:00 UTC
The point
Cloudflare's Q3 2026 DDoS report shows attackers shifting to volume over size. Short, small attacks surged, while hyper-volumetric attacks over 1 Tbps fell by nearly 69 percent from Q2, which Cloudflare links in part to law enforcement taking down four major IoT botnets earlier this year. Vectors rotated hard too: CLDAP floods collapsed, DNS amplification and UDP floods jumped.
Why it matters
If most attacks now end in under 10 minutes, defense has to be automatic. Anything that waits on a human seeing an alert is already too slow.
Key details
- 18.2 million network-layer DDoS attacks mitigated in the quarter, about 8,226 per hour
- 96 percent of attacks ended in under 10 minutes and 98 percent stayed under 1 Gbps
- CLDAP attacks collapsed 99.5 percent quarter over quarter, while DNS amplification surged 215 percent