Tooling4d ago
Cursor marketplace served a tampered Claude Code 2.1.313 extension with an SSH backdoor, affecting at most 5,000 users
Cursor posted a security notice on X at 07:46 UTC on Oct 30: version 2.1.313 of Anthropic.claude-code in its VS Code extension marketplace was a maliciously modified build, not developed by Anthropic, available from about 2:27am to 1:35pm PT on Oct 29 and affecting at most 5,000 users. The payload collects host details, adds an attacker SSH key, tries to open a reverse SSH tunnel and installs persistence. Cursor pulled the version, shut down and rebuilt the marketplace, rotated keys and had the attacker server taken offline; it asks users to update Claude Code for VS Code to 2.1.314 and follow the check and cleanup steps in its blog post.
Release21d ago
Cursor launches the Origin App Marketplace with 20+ CI, deploy, code-review and security integrations, open to public submissions
On Oct 13 Cursor launched the Origin App Marketplace: its code hosting platform Origin now connects to 20+ apps across deployments (Cloudflare, Vercel and more), CI (CircleCI, Buildkite and more), code review (CodeRabbit, Greptile, Tenki), security (Semgrep, Socket and more), monitoring (Sentry) and project management (Linear), and the marketplace is open to public submissions from any developer-tool team.
Tooling10d ago
MCP reference servers v2.1.0 fix eight vulnerabilities: upgrade filesystem and everything to 2.0.1 and fetch to 2026.10.24
On Oct 25 (UTC) the official Model Context Protocol servers repo shipped v2.1.0, fixing eight vulnerabilities in three reference servers: symlink races, trailing quote/whitespace path bypasses and case-insensitive symlink bypasses in filesystem; cross-origin calls over HTTP/SSE in everything; and IDNA host-name and NAT64 internal-address reachability plus robots.txt not rechecked after redirects in fetch. The maintainers warn that npm users still on date versions (2025.x/2026.x) will not be offered the upgrade and must install 2.0.1 explicitly, and that the filesystem write issue is only partly fixed on Windows.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.