MALICIOUS 'CLAUDE CODE' COPY SLIPPED INTO CURSOR'S MARKETPLACE FOR 11 HOURS

Cursor said a malicious copy of extension versions 2.1.312 and 2.1.313 was available in its marketplace from about 2:27 a.m. to 1:35 p.m. Pacific time on October 29, and Microsoft independently analyzed the package.

Microsoft's October 30 research also described two investigated intrusions in which attackers posed as IT support in Teams and persuaded users to grant remote access, primarily through Quick Assist.

Separately, Anthropic researchers demonstrated CVE-2026-98432, a Linux kernel flaw, enabling remote root access on a server running a Multipath TCP (MPTCP) listener.

BleepingComputer reported the flaw affects kernels back to version 4.4, with the kernel's CVE team rating it 9.8 out of 10, though Red Hat initially rated it lower as mainly a crash risk.

The disclosures cap a busy week for software supply-chain security, as developers were urged to verify extension publishers before installing updates.