Cyber Threat Brief — October 30 2026
⚠️ This report is AI-generated. Always validate findings.
1. Trojanized Claude Code extension — 2.1.312 and 2.1.313
TL;DR: Cursor says modified Anthropic.claude-code builds 2.1.312 and 2.1.313, not built by Anthropic, were in its marketplace on 29 October. Uninstalling the extension leaves the SSH key and the persistence scripts in place.
Corrected 31 October: Cursor updated its IOCs on 30 October at 11:30 am PT. This section now covers 2.1.312 as well as 2.1.313, drops the withdrawn darwin-arm64 hash, and labels 3de17229… as the 2.1.312 win32-x64 VSIX.
What’s New:
- The build was in the Cursor marketplace from about 2:27am PT to 1:35pm PT on 29 October.
- Cursor shut that marketplace, rebuilt it, and says the attacker server no longer functions.
- The extension writes an ssh-ed25519 key with comment svc-telemetry into authorized_keys.
- SSH enablement and the reverse tunnel fail without admin on most macOS and Windows hosts, while the key, persistence, and beacon still run.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Anthropic.claude-code 2.1.312 | Malicious extension | T1195.002 | Extension inventory | Remove 2.1.312 if it is installed. Cursor says uninstall alone does not remove the key or the persistence scripts. |
| Anthropic.claude-code 2.1.313 | Malicious extension | T1195.002 | Extension inventory | Remove 2.1.313 if it is installed. Cursor says uninstall alone does not remove the key or the persistence scripts. |
| fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364 | VSIX SHA-256 | T1195.002 | File hash | This is the 2.1.312 darwin-arm64 VSIX hash Cursor published on 30 October. Quarantine a file with this hash. |
| 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 | VSIX SHA-256 | T1195.002 | File hash | This is the 2.1.312 win32-x64 VSIX hash Cursor published on 30 October. Quarantine a file with this hash. |
| 80402fdcad8799285fd93044976973ca000da7995fb93363f819bb8e4f84ee6c | VSIX SHA-256 | T1195.002 | File hash | This is the 2.1.313 darwin-arm64 VSIX hash Cursor published on 30 October. Quarantine a file with this hash. |
| 6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731 | VSIX SHA-256 | T1195.002 | File hash | This is the 2.1.313 win32-x64 VSIX hash Cursor published on 30 October. Quarantine a file with this hash. |
| ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 | extension.js SHA-256 | T1195.002 | File hash | Quarantine extension.js with this SHA-256. Cursor says this is the modified file in 2.1.312 and 2.1.313 on Darwin and Windows. |
| anthropic.claude-code-2.1.312-darwin-arm64/extension.js | Modified file | T1195.002 | Extension directory | On macOS, search that extension.js for 134.209.82.225 and svc-telemetry. |
| anthropic.claude-code-2.1.313-darwin-arm64/extension.js | Modified file | T1195.002 | Extension directory | On macOS, search that extension.js for 134.209.82.225 and svc-telemetry. |
| anthropic.claude-code-2.1.312-win32-x64/extension.js | Modified file | T1195.002 | Extension directory | On Windows, search that extension.js for 134.209.82.225 and svc-telemetry. |
| anthropic.claude-code-2.1.313-win32-x64/extension.js | Modified file | T1195.002 | Extension directory | On Windows, search that extension.js for 134.209.82.225 and svc-telemetry. |
| 134.209.82.225 | C2 address | T1071.001 | Network flow | Block 134.209.82.225 and review egress to it since 29 October. |
| [email protected] TCP 22 | Reverse SSH | T1021.004 | Network flow | Review SSH to [email protected] on TCP 22. |
| http://134.209.82.225:8099/beacon | Beacon URL | T1071.001 | Proxy or EDR network | Review HTTP POST to this URL. |
| http://127.0.0.1:8099/beacon | Loopback beacon | T1071.001 | EDR network | Review HTTP POST to this loopback URL. Cursor lists it as a local beacon attempt. |
| ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P | Public key | T1098.004 | authorized_keys | Remove this key. The comment is svc-telemetry. |
| SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk | Key fingerprint | T1098.004 | SSH key inventory | Match this fingerprint to the svc-telemetry key in authorized_keys. |
| SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ | Tunnel key fingerprint | T1021.004 | SSH key inventory | Match this fingerprint to the reverse-tunnel key Cursor published. |
| ~/.ssh/authorized_keys | SSH key file | T1098.004 | File modification | Search this file for the comment svc-telemetry. |
| %USERPROFILE%.ssh\authorized_keys | SSH key file | T1098.004 | File modification | On Windows, search this file for svc-telemetry. |
| C:\ProgramData\ssh\administrators_authorized_keys | SSH key file | T1098.004 | File modification | Search this file for svc-telemetry. Cursor’s check includes it. |
| ~/.config/.smt | Dropped script | T1059 | File inventory | Look for ~/.config/.smt. Cursor lists it on macOS. |
| ~/.config/.smtk | Dropped file | T1059 | File inventory | Look for ~/.config/.smtk next to .smt. |
| $TMPDIR/.stk_<10 hex> | Tunnel key path | T1021.004 | Temp directory | Look for $TMPDIR/.stk_ plus 10 hex characters. |
| ~/Library/LaunchAgents/com.apple.sysmond.plist | LaunchAgent | T1543.001 | LaunchAgent files | Look for this plist. The label is com.apple.sysmond. |
| %USERPROFILE%.config\smt.cmd | Dropped script | T1059 | File inventory | Look for smt.cmd under the user .config directory. |
| %USERPROFILE%.config\smtk | Dropped file | T1059 | File inventory | Look for smtk next to smt.cmd. |
| %TEMP%.stk_<10 hex> | Tunnel key path | T1021.004 | Temp directory | Look for %TEMP%.stk_ plus 10 hex characters. |
| SysMon | Scheduled task | T1053.005 | Task Scheduler | Look for a task named SysMon. Cursor says it attempts to run as SYSTEM. |
| sysmon.cmd | Startup script | T1547.001 | Startup folder | Look in the user Startup folder for sysmon.cmd. |
| ssh -N -R ’*:0:localhost:22’ | Command line | T1021.004 | Process command line | Review ssh command lines for this remote forward. |
| autossh -M 0 | Command line | T1021.004 | Process command line | Review process command lines for autossh -M 0. |
| schtasks /create /tn SysMon | Command line | T1053.005 | Process command line | Review command lines that create a task named SysMon. |
| systemsetup -setremotelogin on | Command line | T1021.004 | Process command line | Review command lines that turn Remote Login on. |
| Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 | Command line | T1021.004 | Process command line | Review command lines that add the OpenSSH Server capability. |
| @reboot /bin/sh “ | Cron persistence | T1053.003 | User crontab | On Linux, run crontab -l and remove an @reboot entry that runs /bin/sh “ |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | bash/cat command line only. |
| Elastic | Partial — SSH Authorized Keys File Activity | fires only on a first-seen writer process. |
| Sigma | Partial — Port Forwarding Activity Via SSH.EXE | Windows ssh.exe -R only. |
Detection index: ESCU dcd2560 (2026-10-30) · elastic detection-rules 20120ba (2026-10-29) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: List installed extensions and look for Anthropic.claude-code 2.1.312 or 2.1.313. Search authorized_keys for the comment svc-telemetry. On macOS, look for LaunchAgent com.apple.sysmond.plist. On Windows, look for scheduled task SysMon. If any of those are present, isolate the host and rotate credentials from a clean machine.
Sources: Cursor security notice · Cursor on X · Phorion thread · Phorion correction · cyb3rops on the distribution source
2. GitLab — CVE-2026-97229
TL;DR: CISA added CVE-2026-97229 on 29 October, due 1 November 2026. Install the fixed GitLab build, and install a fixed Ruby if the host does not use GitLab’s package.
What’s New:
- CISA added CVE-2026-97229 on 29 October, due 1 November 2026, and forensic triage applies.
- The fixed builds on the affected lines are 19.2.8, 19.3.5, and 19.4.2.
- Rapid7 reproduced command execution as the git user on official GitLab 19.4.1, and the same input did not run on 19.4.2.
- Alpine’s 30 October update says the instance is open again, and they still have no evidence that code ran.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| GitLab 19.2.8 | Fixed build | T1190 | GitLab version | On the 19.2 line, install 19.2.8 or later. GitLab says every 19.2 build before that is affected. |
| GitLab 19.3.5 | Fixed build | T1190 | GitLab version | On the 19.3 line, install 19.3.5 or later. GitLab says every 19.3 build before that is affected. |
| GitLab 19.4.2 | Fixed build | T1190 | GitLab version | On the 19.4 line, install 19.4.2 or later. Rapid7’s input did not run on this build. |
| Ruby 3.3.13 | Fixed Ruby | T1190 | ruby -v | If the host uses its own Ruby on the 3.3 line, install 3.3.13 or later. |
| Ruby 3.4.12 | Fixed Ruby | T1190 | ruby -v | If the host uses its own Ruby on the 3.4 line, install 3.4.12 or later. |
| Ruby 4.0.9 | Fixed Ruby | T1190 | ruby -v | If the host uses its own Ruby on the 4.0 line, install 4.0.9 or later. |
| CI lint worker crash | Log line | T1190 | GitLab Puma and Sidekiq logs | Search Puma and Sidekiq logs for a worker crash during CI lint, and keep those logs. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No GitLab or puma rule. |
| Elastic | None — verified | puma-to-shell is excluded. |
| Sigma | None — verified | webshell parents are httpd or nginx only. |
Detection index: ESCU dcd2560 (2026-10-30) · elastic detection-rules 20120ba (2026-10-29) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Check the self-managed GitLab version. On the 19.2, 19.3, or 19.4 line, install the fixed build in the table. If that host uses its own Ruby, install a fixed Ruby from the table too. Search worker logs for crashes during CI lint. If those crashes line up with a new public project, isolate the host and keep the logs.
Sources: CISA alert, 29 October · KEV catalog · CISA on X · GitLab 19.4.2 patch · Ruby regexp fixes · Rapid7 ETR · Alpine incident
3. Cisco ASA/FTD — CVE-2026-76418
TL;DR: CISA added CVE-2026-76418 on 29 October, due 1 November 2026. The bug is a CVSS 8.6 denial of service when SSL VPN login is reachable and a tunnel group uses secondary authentication.
What’s New:
- CISA added CVE-2026-76418 on 29 October, due 1 November 2026. Forensic triage does not apply.
- Cisco says the PSIRT learned of active exploitation in October 2026.
- A vulnerable release is affected only when SSL remote access VPN login is reachable and secondary authentication is set on a tunnel group.
- If tunnel-group-list enable is set, check every tunnel group, including DefaultWEBVPNGroup.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| ASA 9.16.4.104 | Fixed release | T1499 | ASA version | On 9.16 and earlier, install 9.16.4.104. |
| ASA 9.18.4.96 | Fixed release | T1499 | ASA version | On the 9.18 train, install 9.18.4.96. |
| ASA 9.20.4.50 | Fixed release | T1499 | ASA version | On the 9.20 train, install 9.20.4.50. |
| ASA 9.22.3.200 | Fixed release | T1499 | ASA version | On the 9.22 train, install 9.22.3.200. |
| ASA 9.23.1.48 | Fixed release | T1499 | ASA version | On the 9.23 train, install 9.23.1.48. |
| ASA 9.24.1.27 | Fixed release | T1499 | ASA version | On the 9.24 train, 9.24.1.27 is a first fixed release. |
| ASA 9.24.10.1 | Fixed release | T1499 | ASA version | On the 9.24 train, 9.24.10.1 is also a first fixed release. |
| FTD 7.0.11 | Fixed release | T1499 | FTD version | On 7.0 and earlier, install 7.0.11. |
| FTD 7.2.13 | Fixed release | T1499 | FTD version | On the 7.2 train, install 7.2.13. |
| FTD 7.4.9 | Fixed release | T1499 | FTD version | On the 7.4 train, install 7.4.9. |
| FTD 7.6.7 | Fixed release | T1499 | FTD version | On the 7.6 train, install 7.6.7. |
| FTD 7.7.14 | Fixed release | T1499 | FTD version | On the 7.7 train, install 7.7.14. |
| FTD 10.0.3 | Fixed release | T1499 | FTD version | On the 10.0 train, install 10.0.3. |
| FTD 10.1.1 | Fixed release | T1499 | FTD version | On the 10.1 train, install 10.1.1. |
| no tunnel-group-list enable | Mitigation | N/A | ASA running-config | If DefaultWEBVPNGroup does not use secondary authentication, enter this in WebVPN mode. Users then need the profile name. |
| no secondary-authentication-server-group | Mitigation | N/A | ASA running-config | If DefaultWEBVPNGroup uses secondary authentication, remove it with this command, accepting weaker VPN authentication until you patch. |
| webvpn enable | Vulnerable config | T1499 | ASA running-config or FMC policy | Confirm SSL remote access VPN login is reachable. On ASA that is webvpn then enable on an interface. On FTD it is the FMC or FDM policy. |
| secondary-authentication-server-group | Vulnerable config | T1499 | Tunnel-group config | If the group list is enabled, check every tunnel group, including DefaultWEBVPNGroup, for this setting. |
| crashinfo | Reload artifact | T1499 | crashinfo and syslog | Review crashinfo and syslog for a reload outside a change window, and keep the files if no change matches. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | Watches session volume, not a reload. |
| Elastic | None — verified | No reload or crashinfo rule. |
| Sigma | None — verified | No reload or crashinfo rule. |
Detection index: ESCU dcd2560 (2026-10-30) · elastic detection-rules 20120ba (2026-10-29) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Show the ASA or FTD version and match it to the fixed release for that train. Confirm webvpn is enabled and a tunnel group sets secondary-authentication-server-group. If both are set, install the fixed release. Review crashinfo and syslog for a reload outside a change window. Keep those files if the reload has no matching change.
Sources: CISA alert, 29 October · KEV catalog · CISA on X · Cisco ASA/FTD advisory
Status Updates
- PHP2Shell-CVE-2026-109618 (PAN-OS): KEV due 29 October 2026 is now overdue. Palo Alto’s 29 October update marks all remaining hotfixes released. 28 October brief. Palo Alto CVE-2026-109618.
- CVE-2026-46300 (Fragnesia, Linux kernel): KEV is due 31 October 2026. Boot the fixed kernel from the 29 October brief, and read
/etc/pam.d/subefore that reboot. 29 October brief. - CVE-2026-111357 (Ivanti Connect Secure): Ivanti patched this privilege escalation from the Volexity chain on 29 October, with fixes 25.1.1.3 and 22.8R2.6. Not in KEV. 14 October brief. Volexity. The Stack. Security NEXT.
- CVE-2026-110264 (GitLab): The 19.2.8, 19.3.5, and 19.4.2 builds in section 2 do not fix this CVE. Fixed builds remain 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Not in KEV. 22 October brief.
- Plex2Shell-CVE-2026-96652 (Plex Media Server): CVE-2026-96654 and CVE-2026-96656 were due 23 October 2026 and are overdue. CVE-2026-96652 and CVE-2026-96655 are due 3 November 2026. Fixed build remains 1.43.3.10861. 21 October brief.
- CVE-2026-114625 (VeloCloud): KEV due 26 October 2026 remains overdue. Fixed builds remain 5.2.3.18, 6.1.3.10, and 6.4.2.12. No new IOC set. Retirement is eligible on 2 November 2026. 23 October brief.
- CVE-2026-110447 (Collabora): KEV due 26 October 2026 remains overdue. Update
richdocumentscodeto 26.4.303 or remove it withocc app:remove richdocumentscode. Retirement is eligible on 2 November 2026. 15 October brief. - Retired from watch: SiteGuard-CVE-2026-106931 (last update 2026-10-21), TimeSmuggler-NetScaler-2026-10 (last update 2026-10-23). No new fixed build or IOC set. SiteGuard brief. TimeSmuggler brief.
- Watching (no change): LiteLLM-1.107.0-2026-10 (10-22); CVE-2026-105192 (10-22); Siemens-Software-Center-CVE-2026-110936 (10-21, KEV due 2026-11-03, fixed 4.0.9.8); GhostAction-2026-10 (10-10); UNC7017-AOMEI-2026-10 (10-17); Candiru-AdFection-DiscoverTech-2026-10 (10-18); InfinityCore-2026-10 (10-18); UpdraftCentral-2026-10 (10-19); OVHcloud-CLI-2026-10 (10-20); RankMath-SEO-Pro-3.0.123 (10-20); ConnectWise-CloudBackup-SkyKick-2026-10 (10-22, original 10-17); eMudhra-CVE-2026-111943 (10-27); CVE-2026-111497 (10-28, KEV due 2026-11-10); Tailworm-Tailscale-SSH-2026-10 (10-28); CVE-2026-48356 (10-28, KEV due 2026-11-10); CVE-2026-41709 (10-29); CVE-2026-20127 (10-29).