MSP Threat Briefing: November 3, 2026

CISA has added nothing to its exploited list since October 30. The item to act on today is a developer tool. For about 11 hours on October 29, the Cursor editor's marketplace served a tampered Claude Code extension that tried to plant an SSH backdoor. Separately, Red Hat now has fixed kernels for the critical Linux TCP flaw, and Android's November bulletin fixes a zero-click remote code execution bug.

1. Find every machine with the Cursor editor. Check for the svc-telemetry SSH key and the persistence items below, and rotate secrets on any hit.
2. Patch and reboot RHEL 8, 9 and 10 and Amazon Linux servers for CVE-2026-98432. Keep the interim filter on Ubuntu until its kernels ship.
3. Push the 2026-11-01 Android patch level to managed phones, and flag devices on Android 13 or earlier.

1. Backdoored Claude Code extension served through the Cursor marketplace

Cursor disclosed on October 29 that malicious builds of the Anthropic.claude-code extension were in its marketplace. The affected versions are 2.1.312 and 2.1.313. Cursor says Anthropic did not develop them. The window ran from about 2:27am to 1:35pm Pacific time on October 29. Cursor updated its indicators on October 30.

The code ran when the editor loaded the extension. No one had to use it. It sent host details to the attacker: username, hostname, Git email, public IP and the names of environment variables. It then tried to add an attacker SSH key, turn on the local SSH service and open a reverse tunnel. Cursor says the tunnel step usually failed without admin rights. Cursor estimates up to 5,000 users were exposed, per Sophos.

Cursor removed the extension, rotated its keys, rebuilt the marketplace and had the attacker's server taken offline. It found no other tampered extensions. How the builds were published under Anthropic's name is still unexplained, as reported by BleepingComputer.

Who is exposed. Developers, and anyone else, who ran Cursor on macOS or Windows and installed or updated the Claude Code extension on October 29. That includes client development teams, in-house staff building automations, and MSP staff. A developer laptop often holds cloud keys, Git tokens and production SSH access, so the reconnaissance alone is worth a response.

What to do.

• Inventory machines with Cursor installed. Check the installed extension version and update history for 2.1.312 or 2.1.313.
• Search authorized_keys files for svc-telemetry. On Windows, check both $HOME\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys.
• Removing the extension does not remove the backdoor, per Cursor and Sophos. Delete the key and the persistence items, and stop any tunnel process.
• Rotate credentials and sessions reachable from an affected machine, using a different, trusted machine. Cursor suggests considering a rebuild.
• Cursor publishes cleanup scripts for macOS and Windows on its notice. Read them before running them.
• Hunt firewall and EDR logs for the address below on TCP 22 and 8099.

Indicators published by Cursor:

Cursor notes that lookups to ifconfig.me and api.ipify.org are legitimate services and not indicators on their own.

2. Update: Red Hat and Amazon Linux ship fixes for the critical TCP flaw

The November 1 briefing covered CVE-2026-98432, a use-after-free in the kernel's IPv4 TCP code rated 9.8. At the time, RHEL had no fix. Red Hat released fixed kernels on November 1:

Amazon Linux 2 and Amazon Linux 2023 are fixed, per Amazon's tracker. The Amazon Linux 2023 default kernel fix is ALAS2023-2026-3365, released October 30.

Ubuntu is still not fixed. Its CVE page, updated November 3, shows fixes in progress for 22.04, 24.04, 26.04 and 26.10. It lists 16.04, 18.04 and 20.04 as vulnerable. Red Hat's bulletin still says interim guidance for OpenShift is being evaluated. Red Hat's bulletin does not mention exploitation in the wild.

What to do.

• Install the fixed kernel on RHEL and Amazon Linux and reboot. The update does nothing until the new kernel is running.
• Remove the interim nftables table only after confirming the patched kernel is booted.
• RHEL rebuilds such as Rocky and AlmaLinux usually follow Red Hat. Check their errata before assuming a fix.
• Keep the filter, and tight source-address limits, on Ubuntu servers until Canonical ships kernels.

3. Android November bulletin fixes a zero-click remote code execution flaw

Google published the November 2026 Android bulletin on November 2. It covers 216 CVEs across two patch levels, 2026-11-01 and 2026-11-05. The most severe is CVE-2026-58868, a Critical remote code execution flaw in the Framework. Google says user interaction is not needed. It affects Android 14, 15, 16 and 17. The bulletin does not report exploitation.

The 2026-11-01 level also lists CVE-2026-58882 as a Critical denial-of-service flaw. It has been nicknamed "SMS of Death". Proof-of-concept code is public, and Android 12 and 13 did not receive the fix, as reported by BleepingComputer on October 31.

Who is exposed. Every client with company-owned or BYOD Android phones, including staff whose phones hold the authenticator app and mailbox.

What to do.

• In your MDM, report on security patch level and require 2026-11-01 or later. Devices at 2026-11-05 cover both levels.
• Patch availability depends on the phone maker and carrier. Check the vendor's own bulletin for each model you manage.
• List devices on Android 13 or earlier and plan replacement. They are outside these fixes.

Quick hits

Update: ConnectWise Cloud Backup. The October 30 update says phases 1 and 2 of restoration are complete. Backup and restore work for re-authorized Microsoft 365 tenants, and the end-customer portal and monitoring dashboards are back. Health reporting, exports and billing are next, then notifications. ConnectWise again says to confirm new snapshots complete, and not to re-enable old apps unless told to. No new indicators. The October 29 briefing has the re-authorization steps.

CryptoPayment Gateway WordPress plugin. Attackers are attempting to exploit CVE-2026-81648, rated 10.0, as reported by The Hacker News. A missing authorization check lets anyone delete files and read stored wallet credentials. WPScan lists versions 1.2.1 and 1.2.2 with no fix. The plugin was closed in the WordPress directory on August 28. If a client site has it, remove it and rotate the wallet keys.

Sources

• Cursor: security notice for the malicious Anthropic.claude-code extension
• Sophos: malicious Claude Code extension distributed through Cursor marketplace
• BleepingComputer: malicious Claude Code extension on Cursor planted SSH backdoors
• Red Hat RHSA-2026:93414 (RHEL 8)
• Red Hat RHSA-2026:93412 (RHEL 9)
• Red Hat RHSA-2026:93413 (RHEL 10)
• Red Hat RHSB-2026-016
• Amazon Linux: CVE-2026-98432
• Ubuntu: CVE-2026-98432
• Android Security Bulletin, November 2026
• BleepingComputer: Android SMS of Death exploit
• ConnectWise security advisories
• The Hacker News: attackers target unpatched CryptoPayment Gateway flaw
• WPScan: CryptoPayment Gateway CVE-2026-81648