October 30, 20:05Tecnoblog

Cursor identifies and removes fraudulent extension from Claude Code that reached up to 5 thousand users

Cursor, the developer of the namesake code editor, detected and removed a modified version of the Claude Code extension, provided by Anthropic, which had the potential to affect up to five thousand users. This malicious package aimed to collect computer data and implant an SSH backdoor to enable remote access to the machine.

The corrupted version, identified as Anthropic.claude-code 2.1.313, was accessible on the platform's extension marketplace between 6:27 AM and 5:35 PM on October 29th, Brasília time. After becoming aware of the incident, the company, which has a stake in SpaceX owned by Elon Musk, removed the extension and temporarily suspended the marketplace's operation.

According to the company, no evidence of manipulation was found in other packages. Cursor also proceeded to rebuild the marketplace before reactivating it. Users who may have been impacted by this flaw should contact the platform directly.

The alert issued by Cursor clarifies that the harmful version was not created by Anthropic, but rather disguised itself as the Claude Code package, containing code capable of compromising the device of anyone who installed it. After installation, the software began collecting sensitive information, such as the user's and PC's name, operating system, processor architecture, working directories, Git email, and IP address.

Subsequently, the extension attempted to incorporate an SSH key controlled by the attacker, named svc-telemetry, aiming to create an entry point that could be used in the future. Using this same key, the malware sought to establish a reverse tunnel to an external server, which would give the attacker the ability to remotely access the machine.

To ensure the maintenance of this access even after restarts, the code implemented persistence mechanisms on both Windows and macOS. These routines were configured to attempt to reestablish the connection at intervals of approximately 60 seconds. Additionally, some of the collected information and the connection status with the server were transmitted to the infrastructure managed by the attacker.

However, the attempt at remote access was unsuccessful on most computers. The platform reported that the code had flaws and required elevated permissions to activate the SSH service. Thus, the risk was significantly higher only on equipment where administrator or root permissions were granted to Cursor. Even in these scenarios, the company advises that any individual who installed the compromised version perform a complete system check. This recommendation applies to anyone who installed or updated the Anthropic.claude-code extension to version 2.1.313 during the period it was available. One way to check the device is by looking for the svc-telemetry key, which was added by the malware in the SSH settings.

Similar stories

www.aajtak.inOctober 25, 09:07

Major Data Leak at CBFC: Scripts and Contracts for Over 500 Films Revealed

A major data leak related to the film industry has been discovered. According to reports, documents concerning over 500 films were leaked from the Central Board of Film Certification (CBFC) online portal. Among these stolen materials are film scripts, certification records, and contracts.

This incident occurred via the CBFC's e-Cinepramaan portal, which is used for the film certification process. It is reported that access was gained to some documents on this portal, and they were uploaded to the Internet Archive. However, it is currently unclear how the data leak happened or what volume of information was affected.

Scripts and Contracts Also Become Public Knowledge

The leak affected not only film scripts but also other critical documents. These include CBFC orders and business agreements related to the films. It was noted that some documents contain information about distribution deals and licensing fees.

Since this information is extremely important for filmmakers and distributors, its public disclosure could negatively impact business negotiations and deals. It is important to emphasize that this refers to the leak of associated documents, not that the films themselves were fully published.

CBFC Initiates Investigation

According to available data, CBFC has initiated an investigation into this matter, and a security audit is being conducted. Meanwhile, the Internet Archive has stated its intention to remove the relevant accounts and file a complaint with cybercrime authorities. Information was also provided to the Indian Computer Emergency Response Team (CERT-In).

It remains unclear who is responsible for this leak and how widely the incorrect information has been used. Nevertheless, this case has once again raised questions about the reliability of storing confidential documents on government online portals.

www.aajtak.inOctober 22, 15:03

Critical vulnerabilities found in PHP, eMudhra, and AI-based software within 24 hours

In the last 24 hours, there has been a significant surge in cybersecurity events. Serious security issues have been identified across various domains—from website software and digital certificates to artificial intelligence tools and cloud platforms. Among the discovered flaws were vulnerabilities allowing attackers to execute their code on servers, as well as instances of malicious code injection directly into software updates.

One of the high-profile incidents involved the digital certificates of the Indian company eMudhra, which drew the attention of the global cybersecurity community.

This raises the question of why such a large number of problems occurred simultaneously. Previously, AI leaders warned that powerful AI models are capable of finding software flaws much faster than humans. The public fears that if the speed of AI vulnerability detection surpasses the speed of remediation, the security and privacy of users worldwide will be at risk.

These incidents once again demonstrated that internet security does not depend solely on one company or website. Trust in the internet is maintained by the interaction of multiple components, such as browsers, servers, software updates, and digital certificates. A failure in any of these elements can affect other services and companies. Although no major losses have been reported so far, further assessment of the situation is required.

The most significant event was the discovery of two critical vulnerabilities in the PHP programming language. PHP is widely used for creating websites and web applications, and many servers run on this platform. The Indian cybersecurity agency CERT-In issued a warning about these vulnerabilities on October 21, assigning them the identifiers CVE-2026-109618 and CVE-2026-109619.

By exploiting these vulnerabilities, attackers could execute their code on certain weak servers without needing authorization. This created a risk of gaining control over the server and impacting the services running on it. The PHP team released new security updates to fix these flaws: 8.5.12 for PHP 8.5, 8.4.27 for PHP 8.4, 8.3.36 for PHP 8.3, and 8.2.35 for PHP 8.2. Users of affected sites and servers were advised to promptly install the relevant updates.

Following the disclosure of the risks, attacker activity increased significantly. According to a Reuters report from October 22, Cloudflare recorded a sharp spike in attempted attacks on PHP after the vulnerability information became public. If such attempts previously numbered in the thousands, they reached millions after the disclosure. Many government agencies and companies in different countries began accelerating the checking of their systems and applying security updates.

Nevertheless, attempting to attack a system and successfully stealing data are two different processes. Initial reports have not confirmed any large-scale successful attacks related to this incident.

The history of PHP vulnerabilities also includes an aspect related to artificial intelligence. According to OpenAI, one of the critical vulnerabilities was discovered using GPT-5.6 Sol as part of the 'Patch the Planet' initiative. Independently, the company Wiz also discovered and reported both vulnerabilities. Subsequently, the PHP team and other security companies worked together to fix them.

This case demonstrates that artificial intelligence can be used not only for generating content or answering questions but also for finding hidden vulnerabilities in software. Such technologies can help security teams identify flaws and develop solutions more quickly. However, there is a downside: if attackers begin using similar methods to find vulnerabilities, prepare attacks, and identify weak systems, the reaction time of companies will decrease. Therefore, there is growing concern that attacks may become faster, despite hopes of strengthening cybersecurity with AI.

Concurrently, an issue arose concerning the digital certificates of the Indian company eMudhra. This company issues digital certificates used to ensure secure connections on the internet. Such certificates help browsers determine if a website is trustworthy and guarantee that the secure connection is directed to the correct resource.

According to CERT-In, eight intermediate eMudhra certificates had a vulnerability where their private cryptographic keys were generated in an insecure manner. These keys...