Cyber Threat Brief — October 31 2026
1. Ivanti Connect Secure — CVE-2026-111357
TL;DR: CISA added CVE-2026-111357 on 30 October, due 2 November 2026, and forensic triage applies. Install the fixed build for your train, and factory-reset the appliance if you suspect a compromise.
Corrected 1 November: The 25.1.2.2-and-prior row no longer sends that train to 25.1.1.3 or 22.8R2.6. Upgrade those nodes to the fixed 25.1.3.x release per Ivanti’s advisory.
What’s New:
- CISA added CVE-2026-111357 and CVE-2026-118527 on 30 October.
- CVE-2026-111357 is due 2 November 2026.
- CISA set forensic triage to Yes for CVE-2026-111357.
- Volexity says the integrity checker does not see this chain, because the library patch stays in memory.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Ivanti Connect Secure 25.1.1.3 | Fixed build | T1190 | ICS version inventory | On the 25.1.1 line, install 25.1.1.3. Ivanti’s 29 October table lists it as the resolved build for CVE-2026-111357 and CVE-2026-118527. |
| Ivanti Connect Secure 22.8R2.6 | Fixed build | T1190 | ICS version inventory | On the 22.8 line, install 22.8R2.6. Ivanti’s 29 October table lists it as the resolved build for CVE-2026-111357 and CVE-2026-118527. |
| Ivanti Connect Secure 25.1.2.2 and prior | Vulnerable version | T1190 | ICS version inventory | CISA lists 25.1.2.2 and prior as affected by CVE-2026-111357. Upgrade these nodes to the fixed 25.1.3.x release per Ivanti’s advisory. |
| CVE-2026-111357 | KEV vulnerability | T1190 | Asset inventory | Patch before 2 November 2026. CISA set forensic triage to Yes. If compromise is suspected, back up the config, factory-reset, restore the config, and reset every stored password, certificate, API key, and license credential. |
| CVE-2026-118527 | KEV vulnerability | T1190 | Asset inventory | This predictable-identifier bug is due 13 November 2026. CISA says a remote authenticated attacker can upload attacker-controlled content to a known path. The same fixed builds cover it. |
| dsinvoked | Process behavior | T1068 | ICS process accounting or memory image | Look for dsinvoked running a maintenance task whose program is the Perl interpreter. Volexity says that path runs the task as root. |
| X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi | Request header | T1190 | ICS web log or packet capture | Search requests to /dana-na/auth/url_default/welcome.cgi for this header. Volexity says it routes the request to wu.cgi. |
| 108.165.147.64 | Infrastructure address | T1071.001 | Network flow | Review egress to 108.165.147.64. Volexity names it as the host used for this operation. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | 2024 URI paths only. |
| Elastic | None — verified | No dsinvoked or wu.cgi rule. |
| Sigma | None — verified | No ICS web or dsinvoked rule. |
Detection index: ESCU dcd2560 (2026-10-30) · elastic detection-rules 20120ba (2026-10-29) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Search ICS web logs or packet captures for requests to /dana-na/auth/url_default/welcome.cgi that carry an X-DSCGI-PATH header. In process accounting or a memory image, look for dsinvoked running Perl as root. Review egress to 108.165.147.64. Do not treat a clean integrity-checker run as proof, because Volexity says the patch lives in memory. On any hit, factory-reset the appliance and reset every stored credential.
Sources: CISA alert, 30 October · KEV catalog · CISA alert, 13 October, updated 30 October · Volexity · The Stack · Security NEXT · 14 October brief
2. Trojanized Claude Code extension — 2.1.312 and 2.1.313
TL;DR: Cursor’s 30 October update says malicious Anthropic.claude-code builds 2.1.312 and 2.1.313 were in its marketplace. Remove both, then look for the svc-telemetry key, because uninstall leaves the key and the persistence scripts behind.
What’s New:
- Cursor now names 2.1.312 and 2.1.313, on macOS and Windows, between about 2:27am PT and 1:35pm PT on 29 October.
- Microsoft says those packages were not on the Visual Studio Marketplace or on npm.
- Microsoft published a SHA-256 for the decoded tunnel private-key file. It is in the table.
- Uninstalling the extension still leaves the SSH key and the persistence scripts.
Correction: the 30 October brief listed darwin-arm64 hash 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62 and labeled 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 as 2.1.313. Cursor’s 30 October 11:30 am PT update does not list the first hash, and it lists the second as the 2.1.312 win32-x64 VSIX.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Anthropic.claude-code 2.1.312 | Malicious extension | T1195.002 | Extension inventory | Remove 2.1.312 if it is installed. Cursor says uninstall alone does not remove the key or the persistence scripts. |
| Anthropic.claude-code 2.1.313 | Malicious extension | T1195.002 | Extension inventory | Remove 2.1.313 if it is installed. Cursor says uninstall alone does not remove the key or the persistence scripts. |
| fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364 | VSIX SHA-256 | T1195.002 | File hash | This is the 2.1.312 darwin-arm64 VSIX hash Cursor published on 30 October. Quarantine a file with this hash. |
| 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 | VSIX SHA-256 | T1195.002 | File hash | This is the 2.1.312 win32-x64 VSIX hash Cursor published on 30 October. Quarantine a file with this hash. |
| 80402fdcad8799285fd93044976973ca000da7995fb93363f819bb8e4f84ee6c | VSIX SHA-256 | T1195.002 | File hash | This is the 2.1.313 darwin-arm64 VSIX hash Cursor published on 30 October. Quarantine a file with this hash. |
| 6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731 | VSIX SHA-256 | T1195.002 | File hash | This is the 2.1.313 win32-x64 VSIX hash Cursor published on 30 October. Quarantine a file with this hash. |
| ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 | extension.js SHA-256 | T1195.002 | File hash | Quarantine extension.js with this SHA-256. Cursor says this is the modified file in 2.1.312 and 2.1.313 on Darwin and Windows. |
| 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278 | Private-key SHA-256 | T1021.004 | File hash | Quarantine a file with this SHA-256. Microsoft says it is the decoded tunnel private-key file. |
| 134.209.82.225 | C2 address | T1071.001 | Network flow | Block 134.209.82.225 and review egress to it since 29 October. |
| http://134.209.82.225:8099/beacon | Beacon URL | T1071.001 | Proxy or EDR network | Review HTTP POST to this URL. |
| [email protected] TCP 22 | Reverse SSH | T1021.004 | Network flow | Review SSH to [email protected] on TCP 22. |
| http://127.0.0.1:8099/beacon | Loopback beacon | T1071.001 | EDR network | Review HTTP POST to this loopback URL. Cursor lists it as a local beacon attempt. |
| ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P | Public key | T1098.004 | authorized_keys | Remove this key. The comment is svc-telemetry. |
| SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk | Key fingerprint | T1098.004 | SSH key inventory | Match this fingerprint to the svc-telemetry key in authorized_keys. |
| SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ | Tunnel key fingerprint | T1021.004 | SSH key inventory | Match this fingerprint to the reverse-tunnel key Cursor published. |
| ~/.ssh/authorized_keys | SSH key file | T1098.004 | File modification | Search this file for the comment svc-telemetry. |
| %USERPROFILE%.ssh\authorized_keys | SSH key file | T1098.004 | File modification | On Windows, search this file for svc-telemetry. |
| ~/Library/LaunchAgents/com.apple.sysmond.plist | LaunchAgent | T1543.001 | LaunchAgent files | Look for this plist. The label is com.apple.sysmond. |
| SysMon | Scheduled task | T1053.005 | Task Scheduler | Look for a task named SysMon. Cursor says it attempts to run as SYSTEM. |
| ~/.config/.smt | Dropped script | T1059 | File inventory | Look for ~/.config/.smt. Cursor lists it on macOS and Linux. |
| ~/.config/.smtk | Dropped file | T1059 | File inventory | Look for ~/.config/.smtk next to .smt. |
| /tmp/.stk_<10 hex> | Tunnel key path | T1021.004 | Temp directory | On Linux, look for /tmp/.stk_ plus 10 hex characters. |
| @reboot /bin/sh “ | Cron persistence | T1053.003 | User crontab | On Linux, run crontab -l and remove an @reboot entry that runs /bin/sh “ |
| $TMPDIR/.stk_<10 hex> | Tunnel key path | T1021.004 | Temp directory | On macOS, look for $TMPDIR/.stk_ plus 10 hex characters. |
| %USERPROFILE%.config\smt.cmd | Dropped script | T1059 | File inventory | Look for smt.cmd under the user .config directory. |
| %USERPROFILE%.config\smtk | Dropped file | T1059 | File inventory | Look for smtk next to smt.cmd. |
| %TEMP%.stk_<10 hex> | Tunnel key path | T1021.004 | Temp directory | Look for %TEMP%.stk_ plus 10 hex characters. |
| %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd | Startup script | T1547.001 | Startup folder | Look in the user Startup folder for sysmon.cmd. |
| ssh -N -R ’*:0:localhost:22’ | Command line | T1021.004 | Process command line | Review ssh command lines for this remote forward. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | bash or cat command line only. |
| Elastic | Partial — SSH Authorized Keys File Activity | first-seen writer process only. |
| Sigma | Partial — Port Forwarding Activity Via SSH.EXE | Windows ssh.exe -R only. |
Microsoft Defender Antivirus detects the macOS payload as HackTool:MacOS/RevAnthShell.A.
Detection index: ESCU dcd2560 (2026-10-30) · elastic detection-rules 20120ba (2026-10-29) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Remove Anthropic.claude-code 2.1.312 and 2.1.313. Hash leftover VSIX files against the table. Search authorized_keys for svc-telemetry. On macOS, look for LaunchAgent com.apple.sysmond.plist. On Windows, look for scheduled task SysMon. If any match, isolate the host and rotate credentials from a clean machine.
Sources: Cursor security notice · Microsoft Security Blog · Microsoft Threat Intelligence on X · cyb3rops on the IOC update · 30 October brief
Status Updates
- CVE-2026-46300 (Fragnesia, Linux kernel): KEV is due today, 31 October 2026. Confirm every Linux host has booted the fixed kernel listed in the 29 October brief. 29 October brief.
- CVE-2026-97229 (GitLab): Metasploit
gitlab_cicd_regexp_rce_cve_2026_97229merged 30 October. It needs a user who can push to a public project; CI lint then runs as git. Due 1 November 2026. 30 October brief. PR 22017. - Ruby Onigmo (GitLab packaged Ruby): KEV due 1 November 2026. The new module targets GitLab’s packaged Ruby, not a separate Ruby service. Fixed Rubies remain 3.3.13, 3.4.12, and 4.0.9. 30 October brief.
- CVE-2026-76418 (Cisco ASA/FTD): KEV due 1 November 2026. No new fixed release or IOC. 30 October brief.
- CVE-2026-102764 (BeyondTrust Remote Support): Reopened after Rapid7’s 30 October Metasploit module, which uploads PHP to the public web directory and requests it without a
.phpextension. Apply BT26-05-RS; KEV was due 19 October. 26 October brief. Rapid7 analysis. - PHP2Shell CVE-2026-109618 (PAN-OS): KEV was due 29 October and is overdue. hunt.io ties a PAN-OS repackaging host to 130.94.67.235 and says shells are confirmed only on honeypots and sensors. 28 October brief. hunt.io.
- Retired from watch: UNC7017-AOMEI-2026-10 (last update 2026-10-17). No new tampering report or IOC set. 17 October brief.
- Watching (no change): LiteLLM-1.107.0-2026-10 (10-22); CVE-2026-105192 (10-22); CVE-2026-110264 (10-22); Siemens-Software-Center-CVE-2026-110936 (10-21, KEV due 2026-11-03, fixed 4.0.9.8); Plex2Shell-CVE-2026-96652 (10-21, KEV due 2026-11-03); CVE-2026-114625 (10-23, retirement eligible 2026-11-02); CVE-2026-110447 (10-15, retirement eligible 2026-11-02); GhostAction-2026-10 (10-10); Candiru-AdFection-DiscoverTech-2026-10 (10-18); InfinityCore-2026-10 (10-18); UpdraftCentral-2026-10 (10-19); OVHcloud-CLI-2026-10 (10-20); RankMath-SEO-Pro-3.0.123 (10-20); ConnectWise-CloudBackup-SkyKick-2026-10 (10-22, original 10-17); eMudhra-CVE-2026-111943 (10-27); CVE-2026-111497 (10-28, KEV due 2026-11-10); Tailworm-Tailscale-SSH-2026-10 (10-28); CVE-2026-48356 (10-28, KEV due 2026-11-10); CVE-2026-41709 (10-29); CVE-2026-20127 (10-29).