Malicious Claude Code extension distributed through Cursor marketplace
2026-10-30T20:51:33Z•e9843f48ea965bdffacde125cbc140f09242a3bb49564a06d8004b8c5a2fed3f
CVE-2026-109618CVE-2026-109619CVE-2026-111497AI-agent-securityAur0raClaude-CodeCursor-marketplaceGOLD-OGRENode2ShellPHPSIEMactive-exploitationartificial-intelligenceincident-responsemalicious-extensionmalwarephysical-securityproof-of-concept-exploitransomwaresocial-engineeringsupply-chain-attack
What happened
Sophos security news covering a malicious Claude Code extension distributed via the Cursor marketplace, social engineering and physical penetration-testing weaknesses, AI-assisted Aur0ra ransomware activity by GOLD OGRE, active exploitation of the Node2Shell vulnerability (CVE-2026-111497), AI-agent access control, incident response, SIEM strategy, and proof-of-concept exploitation of PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sophos_news
- Record identifier
- e9843f48ea965bdffacde125cbc140f09242a3bb49564a06d8004b8c5a2fed3f
- Enrichment time
- 2026-10-30T20:51:33Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.