Anthropic VS code extension on Cursor backdoored for nearly 12 hours

An Ars Technica security RSS digest covering major October 2026 incidents and research, including a backdoored Anthropic Cursor extension, massive cryptocurrency theft, sensitive government-worker data exposure, critical UEFI/EDK2 code execution, TLS certificate authority compromises, actively exploited Plex and PHP vulnerabilities, Tor exit-node hijacking, mercenary spyware delivered through zero-click exploits, and emerging risks in AI agents and IoT self-replication. The feed contains multiple high-impact or potentially critical items, but most entries lack confirmed vulnerability IDs and,3