All items

Parameter researchers showed that a malicious ChatGPT share link could run attacker code inside the session of anyone who opened it, letting the attacker read private conversations. OpenAI received the report on October 18, fixed the flaw eight days later, and rated it P1, its most serious category.

Cursor reported that a tampered copy of the Claude Code extension (anthropic.claude-code, versions 2.1.313 and 2.1.312) was served in the Cursor extension marketplace for a few hours on October 29, 2026. The injected JavaScript loader runs when the extension module loads and attempts to add an attacker-controlled SSH key, enable the local SSH service, set up reverse SSH forwarding, configure persistence, and report host details. Microsoft states that the Visual Studio Marketplace and npm packages were not affected.

A series of agentic attacks has hit at least nine AI developer platforms in October, including Fireworks AI, Zeabur, Lightning AI, OpenCode, Railway, Warp, and Northflank, leading to LLMJacking at scale. Fireworks, Zeabur, and Lightning attribute their incidents to credential access, while Railway cites privilege escalation in its build infrastructure and Warp points to a third-party vendor dependency. Wiz reports downstream abuse of enterprise credentials stolen in these vendor breaches, beginning with a single InvokeModel call from a residential IP address within 30 minutes of the reported credential access.

Anthropic researchers built an exploit for CVE-2026-98432, a use-after-free flaw in the Linux kernel's IPv4 TCP networking code that Linux kernel CVE team scored 9.8 out of 10. Unauthenticated attackers could execute commands as root remotely on servers running MPTCP listeners, and the flaw affects kernels back to version 4.4. The source states that Anthropic's exploit took about 53 minutes to achieve remote root code execution.

A tampered Anthropic Claude Code extension was live in Cursor's IDE extension marketplace for roughly 11 hours on Thursday, and Cursor says at most 5,000 users downloaded it. The extension carried a backdoor, but a flaw in its design kept it from fully establishing itself on most targets. Anthropic says it did not build, publish or host the malicious copy and that its own systems were not compromised, while how the upload reached the marketplace remains unclear.

Immich, a self-hosted photo and video manager, has an unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py that passes caller-supplied options into model construction without restricting security-sensitive parameters. An attacker with network access could set cache_dir to an arbitrary writable path, causing model downloads to write there and clear_cache() to call shutil.rmtree() on that path after certain model-loading failures, which may modify mounted data or recursively delete an attacker-selected directory. The model-name allowlist prevents arbitrary-model deserialization or code execution.

Two serious security issues affected Cursor on the same day. The reports highlight risks for AI-powered integrated development environments (IDEs).