Malicious Claude Code extension distributed through Cursor marketplace
2026-10-31T20:51:31Z•8c318526e3c2aca1c64f4aebf1a123358accf3c34f25fda29a8769281c9a8c77
CVE-2026-109618CVE-2026-109619CVE-2026-111497AI agent securityAI-assisted attacksAur0raClaude CodeCursor marketplaceGOLD OGRENode2ShellPHP vulnerabilitiesSIEMactive exploitationincident responsemalicious extensionphysical penetration testingproof-of-concept exploitransomwaresocial engineeringsupply-chain compromise
What happened
Sophos reports multiple October 2026 cybersecurity developments, including a malicious Claude Code extension distributed via the Cursor marketplace, AI-assisted Aur0ra ransomware activity by the GOLD OGRE group, active exploitation of Node2Shell (CVE-2026-111497), and public proof-of-concept exploits for PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. The feed also covers physical social engineering, incident response preparedness, AI-agent access control, breach measurement, and SIEM alternatives.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sophos_news
- Record identifier
- 8c318526e3c2aca1c64f4aebf1a123358accf3c34f25fda29a8769281c9a8c77
- Enrichment time
- 2026-10-31T20:51:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.