Notes on coding agents and the pages they leave behind, on moving between notes apps, and on the plain mechanics of keeping what you think. Written and published from a Sumibako vault.
Security news, 25 October to 2 November 2026: a backdoored Claude Code extension, an unpatched Linux bug and Trigger.dev
A tampered Claude Code extension in Cursor's marketplace, CVE-2026-98432 still unpatched on Ubuntu, and Trigger.dev: what happened and what to check.
Prashant Shaw
Founder, Sumibako
6 min read
Last week I published a comparison that ends with a recommendation: install the Claude Code extension inside Cursor and get both for $28 a month. The day before it went live, for about eleven hours, the copy of that extension in Cursor's marketplace was planting an attacker's SSH key on the machines that installed it. So this roundup starts where it should, with the one command to run if you took my advice, and then moves on to everything else that went wrong between 25 October and 2 November 2026.
It is shorter than October's, because I only kept what I could confirm from the vendor's own notice or a named report. Checked on 3 November 2026, and Ubuntu's tracker again on 6 November, when every supported release still read Vulnerable. Three incidents, one theme: the thing you trusted was the way in.
🗓️ The week, in order
27 October. Anthropic's Frontier Red Team published a post about an exploit for CVE-2026-98432, a Linux kernel TCP bug, written by an unreleased Claude research model. It ran commands as root on servers with a multipath TCP listener (CSO Online, webhosting.today).
29 October. Between about 2:27am and 1:35pm Pacific, a tampered build of Anthropic's Claude Code extension sat in Cursor's extension marketplace. The same day, Go's security team warned that the kernel bug is not specific to multipath TCP, which Go programs use by default when they listen since Go 1.24.
30 October. Cursor updated its notice to say two versions were affected, not one. The security firm Phorion, which found it, published its analysis. Red Hat rated the kernel bug Critical.
1 November. Red Hat shipped fixed kernels for RHEL 8, 9 and 10. Trigger.dev, a platform for background jobs, disclosed that an attacker had read environment variables for some of its customers.
2 November. A post called WTF Ubuntu? went to the top of Hacker News, because Ubuntu still had no fixed kernel. As I write, it still does not.
🚪 The Claude Code extension that Anthropic did not publish
Cursor's security notice is the primary source, and it is unusually clear. Versions 2.1.312 and 2.1.313 of Anthropic.claude-code for Windows and macOS, in Cursor's own marketplace, were malicious, and "These malicious versions of the extension were not developed by Anthropic." Anthropic said the same, more bluntly. Felix Rieseberg, of its technical staff, as quoted by The Register: "A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish."
What the tampered build did, per Cursor: it collected the host name, user name, OS, Git email, public IP and the names of your environment variables, appended an attacker's SSH key to authorized_keys, tried to turn on the SSH service and open a reverse tunnel, and installed a LaunchAgent or a scheduled task to keep retrying every minute or so. Help Net Security reports Cursor's count: "At most 5,000 users were affected, and the company plans to contact them directly."
There is one piece of luck in it. Turning on SSH needs administrator rights, and the attacker's code had bugs, so on most machines that step failed. Phorion found the macOS one: the script asks for the Remote Login setting without admin rights, gets an error message instead of "Off", and never tries to switch it on. Cursor's notice is careful not to make that the headline, and neither should I: the key, the persistence and the report home all still happened.
If you installed or updated Claude Code inside Cursor on 29 October:
1️⃣ Look for the key. On macOS, Cursor's one-liner is grep -qs svc-telemetry ~/.ssh/authorized_keys, and the notice has a PowerShell version for Windows.
2️⃣ Do not trust the label alone. Phorion notes the malware checks for the comment, not the key, so "it's worth checking the public-key fingerprint rather than relying solely on the comment string." Cursor lists the fingerprint, SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk.
3️⃣ Run Cursor's remediation script, not just Uninstall. "Uninstalling the extension may not be sufficient", because the payload leaves its own scripts behind.
4️⃣ Rotate what the machine could reach, from a different machine. Names of environment variables are not their values, but a working backdoor would not have stopped at names.
📝NOTE
If your copy updated itself overnight, that is exactly the problem. As a researcher quoted by Help Net Security put it, "Checking the publisher name doesn't help when the publisher is real." Turning off automatic extension updates in Cursor is the kind of advice I would have called paranoid last month.
Nobody has said how the attacker got access to Cursor's marketplace. Cursor rotated its keys and rebuilt it; Anthropic says its official channels were never affected. The comparison post still stands, with a new footnote: install the extension, and look at the version number.
🐧 CVE-2026-98432, and the race to ship a kernel
The bug is a use-after-free in the code that turns a pending TCP connection into a socket. Ubuntu's tracker dates the CVE to 15 October and scores it 9.8. Per webhosting.today, the upstream fix was applied on 5 October, credited to an Anthropic researcher, and the bug goes back to Linux 4.4, which is to say most of the Linux servers that exist.
Anthropic's exploit needs a multipath TCP listener, and webhosting.today has the useful caveat: Anthropic's exploit "requires an exposed MPTCP listener, although the underlying flaw is not limited to MPTCP." Two details make that less comforting than it sounds. Go programs listen with MPTCP by default since Go 1.24. And Anthropic has not published the exploit code, so the rest of us are taking the 53 minutes on trust.
Who has shipped a fix, as of 2 November, from that same write-up and Debian's tracker:
Distribution
Fixed kernel
Debian 12 and 13
Yes
RHEL 8, 9 and 10
Yes, from 1 November
Oracle Linux (UEK)
Yes
AlmaLinux 8
Yes; 9 and 10 in testing
Ubuntu, every supported release
No; the tracker reads "Vulnerable", with work in progress
The WTF Ubuntu? post has the line that got it to the top of Hacker News: Ubuntu's own site promises "timely patches for critical vulnerabilities." Its author took their Ubuntu servers offline, and added a timestamp I respect: "This is true as of 2026-11-02 14:48 UTC." If you run Ubuntu, check the tracker today, find out whether anything on the box listens with MPTCP, and keep the fix on your list for the day it lands.
🔑 Trigger.dev, and environment variables again
Trigger.dev's disclosure, dated Sunday 1 November and signed by its CTO, is four sentences long. "We've blocked the exploit used in this attack, but our investigation has identified exposure across a subset of organizations." Then the sentence that matters: "The attacker gained unauthorized access to environment variables for these organizations." Affected owners were emailed.
That makes three platforms in three weeks, after Railway and Zeabur in October, whose customers' environment variables were read. If you use Trigger.dev and did not get the email, you were probably not in the subset. If you did, rotate every secret in that project, starting with the ones that can spend money.
🧵 What the week had in common
None of these was a phishing email. The extension came from the official listing, under the real publisher's name. The kernel bug was in the TCP code every server runs. The environment variables were where the platform tells you to put them. The usual advice, check the sender and the spelling, would have caught none of it.
What would have helped is boring: knowing which version of an extension you are running and when it changed, knowing how many days your distribution takes to ship a kernel, and keeping secrets somewhere you can rotate in an hour. That last list, which keys live where and how to rotate each, is the page you want open while everything else is on fire. I make Sumibako, a notes app, and a private page there does the job; so does a text file, as long as it is not in an environment variable.
This site runs on Vercel and Convex, so the kernel is their problem this week, which is one of the few perks of renting. The extension is everybody's problem. Run the grep, then check the fingerprint, because the label is exactly what the attacker chose.
