News
cybersecurity CISA says max severity GitLab flaw now exploited in the wild - BleepingComputer threat-intel Trezor Warns of Suspected Spy Implant That Could Steal Crypto Wallet Recovery Phrases - GBHackers threat-intel CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229 - GBHackers cybersecurity CISA Warns of Critical GitLab RCE Vulnerability Actively Exploited in Attacks - CyberPress cybersecurity Fresh WordPress Vulnerability in Attackers’ Crosshairs - SecurityWeek threat-intel Microsoft Releases Emergency Fix for Windows 11 Remote Desktop Connection Failures - GBHackers threat-intel Hackers Exploit Ivanti Connect Secure Zero-Day Vulnerabilities to Gain Root Access and Steal Credentials - GBHackers threat-intel Fake Polymarket Scam Network Claims Nearly $11 Million in Cryptocurrency Deposits - GBHackers cybersecurity The $6.3 Billion Binance Hack Was Pulled Off in Just 20 Minutes - Wired Security cybersecurity Microsoft Fixes Windows 11 Bug Blocking Remote Desktop Connections for Non-Admin Users - CyberPress ai The Download: GLP-1s and eating disorders, self-aware cities, and forever chemicals - MIT Technology Review cybersecurity Microsoft finally fixes VPN issues caused by September updates - BleepingComputer cybersecurity Belarus-Linked Hackers Deploy Wiper Malware in First Documented Destructive Attack on Ukraine - CyberPress cybersecurity Drupal Commerce Core Vulnerability Exploited Against Online Stores - SecurityWeek cybersecurity Hackers Exploit Ivanti Connect Secure Zero-Day Vulnerabilities to Gain Root Access and Steal Credentials - CyberPress
1 / 15
All news ›
Cybersecurity

Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace · Cursor

Pro CISO ·

On October 29, a malicious version (2.1.313) of the Anthropic.claude-code extension, not developed by Anthropic, was briefly available in the Cursor VS Code extension Marketplace. It installed a persistent SSH backdoor and sent host details to an attacker server, which Cursor has since taken offline. Up to 5,000 users may have been affected, and Cursor is contacting them directly. Affected users should check for an unauthorized SSH key, run the provided remediation scripts, and rotate credentials accessible from impacted machines.

Continue on cursor.com ↗ ‹ All news Get the newsletter

The summary and image come from Pro CISO; the image is shown from their website.