Cybersecurity daily — 1 November 2026: MCP migration and corrected extension scope
Smithery's connection-management shutdown date has arrived; Cursor's notice also names 2.1.312. Distinguish planned shutdown, observed operation and verification time.
نص المقال ما كاينش بهاد اللغة؛ كنوريو الإنجليزية.
Window: 31 October 2026 08:00 to 1 November 2026 08:00 JST. Few important new announcements were established in the reviewed material. This report covers one migration deadline and one correction to the previous article; neither is a newly occurring vulnerability.
## 1. Smithery: the announced connection-management shutdown date has arrived
The official notice names 31 October for shutting down MCP Proxy and managed identity while retaining a public non-proxied registry. It lists run.tools/server.smithery.ai URLs, API/Connect/Toolbox, accounts/API keys and CLI/SDKs. The notice's exact publication date is unverified; this report's change is the deadline arriving. Complete shutdown of every connection was not independently tested.
Architecture implication: an accessible directory does not establish continued connection or identity-management service. Inventory configuration and secret references and migrate to official provider MCP URLs. Replacing a URL does not carry over OAuth issuer, audience, scopes, user association or stored tokens. Reauthenticate through each provider's documented flow and confirm old-key handling and revocation. These are our implementation checks, not proof that migration has succeeded.
Verification addendum: after the reporting cutoff, the status page updated at 08:11 JST on 1 November still displayed API/Gateway operation. Neither that display nor the scheduled date proves how an individual connection behaves. Primary sources: [Official shutdown notice](https://smithery.ai/future) / [Status](https://status.smithery.ai/).
## 2. Correction: Cursor investigations should not cover only 2.1.313
The previous article named 2.1.313. The official notice now reviewed names modified Anthropic.claude-code 2.1.312/2.1.313 packages for Windows and macOS. The original notice is dated 29 October; the exact time the additional version was included is unverified. This is not evidence of new distribution today, and the previous article receives a correction.
Expand investigations that searched only 2.1.313, matching origin, OS, package hashes and execution evidence. Do not classify every package with the same version as infected or treat extension update/removal as completed recovery. Isolate hosts with unauthorized keys/persistence and assess removal, rebuilding and credential rotation. Primary source: [Cursor notice](https://cursor.com/blog/claude-code-extension-security-notice).
## Decisions
Act now: inventory Smithery-mediated connections and revisit Cursor scope. Evaluate: denial on failed authentication, reduced privileges, tool execution and revocation after migration. Monitor: Wasmtime updates and actual Brotli runtime patch levels. No important new TEE or authentication-standard change was established; remediation in the reader's environment remains unverified.