Cybersecurity daily — 31 October 2026: extension removal is not incident recovery
Cursor extension follow-up, Wasmtime UDP authorization bypass, and updated AWS Brotli mitigation status. Check host privileges, network authorization and deployed patches.
متن المقالة غير متاح بهذه اللغة؛ يُعرض النص الإنجليزي.
Window: 30 October 2026 08:00 to 31 October 2026 08:00 JST. Three follow-ups/database developments. Incident or fix dates are distinguished from the updates reviewed in this window.
Correction (1 November 2026): the current Cursor notice identifies modified 2.1.312 and 2.1.313 packages for Windows/macOS. Read the original 2.1.313-focused scope below as corrected accordingly. The exact publication time of the added scope is unverified.
## 1. Cursor: execution authority also exists outside the agent
Following OX Security's explanation dated 30 October, we rechecked Cursor's security notice. The explanation's exact publication time is unverified. Distribution of the modified Anthropic.claude-code 2.1.313 ran from 29 October 18:27 to 30 October 05:35 JST, before this window. This is not a newly occurring compromise. Cursor says it has no evidence that other versions or the official distribution are affected.
Reported behavior includes adding an unauthorized SSH key, persistence and host-information reporting. These can remain even when enabling the SSH service fails through insufficient privilege or other errors. Attacker infrastructure being offline is not proof of endpoint recovery. Match package installation/execution history against official indicators, isolate hosts with execution evidence, remove unauthorized keys, persistence and tunnels, assess rebuilding, and rotate reachable credentials and sessions from a trusted host.
Architecture implication: a sandbox for agent tools does not by itself protect a host IDE extension. Track distribution origin and package hashes, and separate extension-update evaluation environments from production credentials. Avoid asserting the initial intrusion mechanism or confirmed victim count. Primary sources: [Cursor notice, 29 October](https://cursor.com/blog/claude-code-extension-security-notice) / [OX explanation, 30 October](https://www.ox.security/blog/malicious-claude-code-extension-cursor-ssh-backdoor/).
## 2. Wasmtime: a race turns receive permission into send permission
GHSA-hmmr-87qq-258j, published by the maintainer on 29 October, entered RustSec at 19:42 JST on 30 October. In wasip3 UDP, a peer can change after send authorization so a datagram reaches a destination allowed only for receiving. Affected versions of wasmtime-wasi are 48.0.0–48.0.7, 49.0.0–49.0.4 and 50.0.0, for embedders exposing wasip3 sockets with asymmetric per-address send/receive policy. The CLI and wasip2 are unaffected.
Upgrade to 48.0.8, 49.0.5 or 50.0.1. Pending upgrade, consider disabling the affected UDP guest API and test races between peer changes and asynchronous authorization. Wasm memory isolation alone does not guarantee network authorization. The reviewed maintainer report does not describe in-the-wild exploitation. Primary sources: [Maintainer advisory](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmmr-87qq-258j) / [RustSec entry commit](https://github.com/RustSec/advisory-db/commit/dc7397660430c5634a4b84e5fccf872bd3074feb).
## 3. AWS: Brotli patch rollout status updated
The bulletin updated at 14:00 PDT on 30 October (06:00 JST on 31 October) now reports Phase 1 and 2 of Lambda ZIP security patch rollout complete; the October 29 draft described staged rollout. Separately, rollout of regression-fixed Node.js 24.22.2 is ongoing. This is not a new discovery of CVE-2026-111497. Rebuild and redeploy containers; check actual ZIP runtime patch evidence in cold-start INIT_START logs. Separate planned rollout from the runtime actually in use. Primary source: [AWS update](https://aws.amazon.com/security/security-bulletins/2026-155-aws/).
## Decisions
Act now: inspect extension execution evidence, Wasmtime APIs/versions and deployed Brotli patch levels. Evaluate: separate extension privileges and recheck authorization around asynchronous work. Monitor: the intrusion mechanism, Node.js 24.22.2 rollout and Clerk/PDF MCP actions. No important new TEE change or completed remediation in the reader's environment is established.