The Exploit Bulletin — Wednesday, November 4, 2026: 2 issues require action
Wednesday, November 4, 2026 — 2 issues require action. If you run none of the software below, you are done.
Affects: Cursor/anthropic.claude-code · cPGuard
1. Tampered Claude Code extension in Cursor marketplace installed SSH backdoor
SUPPLY-CHAIN COMPROMISE · CRITICAL
Developer machines that installed these versions may still have a persistent SSH backdoor that gives the attacker access to source code, cloud credentials and internal networks.
On 29 October, an attacker with access to Cursor's extension marketplace published tampered versions 2.1.312 and 2.1.313 of anthropic.claude-code. They stayed live for about 11 hours. The extension ran JavaScript on load that set up a persistent reverse SSH tunnel on macOS and Windows, and about 5,000 developer systems may have downloaded it.
Affected: anthropic.claude-code 2.1.312 (Cursor marketplace); anthropic.claude-code 2.1.313 (Cursor marketplace)
How to Test: Inventory Cursor installs and check extension directories and update history for anthropic.claude-code 2.1.312 or 2.1.313 installed on or after 29 October. On any match, look for unexpected SSH processes, outbound reverse tunnels, new authorized_keys entries, and persistence items such as LaunchAgents, scheduled tasks or Run keys, using Microsoft's published detection guidance.
How to Mitigate: Uninstall the affected versions and install the official extension. Remove the SSH backdoor and its persistence, or reimage the machine. Rotate SSH keys, cloud, git and API credentials that were on the affected machines.
Evidence: SecurityWeek: Malicious Claude Code Extension Served in Cursor Supply Chain Attack · Microsoft Security blog index referencing analysis of the malicious Claude Code-branded extension and its SSH backdoor
2. Malicious update pushed through compromised update channel installs root backdoor and steals credentials (cPGuard)
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · CRITICAL
The malicious updates were live on 2 November and auto-updating servers pulled them without operator action; the vendor published the advisory on 3 November and says the attacker has already retrieved stolen credential files, so password hashes, SSH keys and database credentials from affected hosts may be in use now.
OPSSHIELD, the vendor of the cPGuard server-security product for web hosting servers, states that on 2 November 2026 at 02:06 UTC an attacker with compromised credentials gained access to its update distribution CDN and distributed a malicious script (cpguard-v58812-i91511.sh) through the cPGuard update channel as versions 5.88.12–5.88.19. On servers that ran it, the script installed a backdoor shell at /var/tmp/.cpg91511_sh and collected /etc/shadow, /etc/passwd, root my.cnf, root shell history and root SSH authorized_keys/known_hosts, staging them in /var/tmp/.cpg91511/loot.tgz and uploading them to OPSSHIELD's own licensing server under a compromised account. The vendor says the attacker retrieved at least 32 collected files, each corresponding to a customer server, and that the attack was detected within 12 hours. Version 5.88.25 removes the backdoor and staged files; a further update removes OPSSHIELD's support-access keys from customer servers. Because cPGuard auto-updates, no attacker interaction with the victim server was needed. Not known: how the vendor's credentials were obtained, which individual servers' data was exfiltrated, and whether anything beyond the collection and backdoor ran; there is no CVE and no independent coverage as of publication.
Affected: cPGuard 5.88.12 through 5.88.19
How to Test: You run the affected software if /opt/cpguard exists or cpgcli --version works. Run grep 'Successfully updated' /opt/cpguard/logs/install_log and look for any entry showing 5.88.12, 5.88.15, 5.88.17, 5.88.18 or 5.88.19 (any version in 5.88.12–5.88.19); any such entry means the server installed a malicious update and should be treated as compromised even if it now runs 5.88.25+. Look for the backdoor shell /var/tmp/.cpg91511_sh, the directory /var/tmp/.cpg91511 and the archive /var/tmp/.cpg91511/loot.tgz, and for the script name cpguard-v58812-i91511.sh in process or file history; note the corrective update deletes these, so their absence does not clear the host. Also review outbound connections to OPSSHIELD's licensing server after 2026-11-02 02:06 UTC and any unexpected SSH logins since then. A missing or incomplete log does not establish the server was unaffected.
How to Patch: Run cpgcli update --start on every cPGuard server, then confirm cpgcli --version shows 5.88.25 or later (contact OPSSHIELD Support if the update fails). On any server that installed 5.88.12–5.88.19: reset root and all password-enabled local Linux accounts from a trusted recovery environment, change any passwords reused elsewhere from a trusted device, rotate MariaDB/MySQL root and other database passwords, S3 access keys, DigitalOcean tokens and any secrets present in root's shell history, replace SSH private keys under /root/.ssh and remove the corresponding old public keys from every system that trusts them. Apply the vendor's follow-up update that removes OPSSHIELD support-access keys. The vendor does not currently recommend a routine OS rebuild but says to rebuild if integrity cannot be established.
Evidence: OPSSHIELD cPGuard security advisory: Update channel compromise
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
