10/28/2026-11/04/2026 GitHub Launches npm Firewall; Linux Kernel CVE-2026-98432; Red Hat Patches 9.8-Rated Linux TCP RCE Flaw And More.

1. Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor

A trojanized version of Anthropic’s Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor. Cursor says at most 5,000 users were affected, having installed it between roughly 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. The malicious versions, 2.1.312 and 2.1.313, were published under the legitimate ID (anthropic.claude-code). Cursor has since rebuilt its marketplace and rotated its keys.

The injected loader adds an attacker-controlled key labeled “svc-telemetry” to ~/.ssh/authorized_keys, sets up a reverse SSH tunnel, installs persistence, and sends host details, including environment variable names tied to keys and secrets, to an attacker server. Enabling SSH requires admin rights, so remote access often fails on macOS and Windows, but the key, persistence, and data exfiltration still occur.

Anthropic, Microsoft, and Socket say Open VSX, the VS Code Marketplace, and npm were unaffected, and Anthropic’s systems weren’t compromised. How the attacker gained publishing access remains unknown.

Affected users should isolate hosts, remove the unauthorized SSH keys and persistence, and rotate credentials and sessions. Removing the extension alone does not clear these artifacts.

2. GitHub Launches npm Firewall to Block Malicious Packages Before Installation

GitHub has launched a public preview of a package firewall that blocks suspicious npm packages at install time. It sits between endpoints or internal registries and upstream repositories, inspecting metadata requests and downloads as an “install-time policy gate.” It’s available to all GitHub Enterprise Cloud customers, including data-resident ones.

The tool targets malware that strikes during installation, a risk that grows when AI agents and CI runners install dependencies automatically. Administrators configure policies, including:

• Blocking packages with active malware advisories
• Blocking by vulnerability severity (default: “Critical only”)
• Blocking attestation downgrades lacking SLSA attestation
• Blocking newly added preinstall/postinstall scripts
• Enforcing a cooldown of 1 to 365 days (default: 1; 0 disables it)

Users can request exceptions for erroneously blocked packages, subject to administrator approval. Meanwhile, Rust 1.100, due November 12, 2026, will add a configurable “global-min-publish-age” option, defaulting to seven days. Similar cooldowns now exist across npm, Python, VS Code, Ruby, Bun, pnpm, and Yarn.

Socket notes the tradeoff: legitimate fixes are delayed, and undetected malware can outlast any cooldown. Still, the delay buys defenders time to act.

3. Linux Kernel CVE-2026-98432: Critical TCP Use-After-Free, RHEL Fixed, Ubuntu Pending

Red Hat shipped fixed kernels for RHEL 8, 9 and 10 on 1 Nov and raised its score to CVSS 9.8, Critical. Amazon Linux 2 and the Amazon Linux 2023 default kernel are also fixed. Ubuntu still has no fix, and OpenShift 4 and RHEL 9 real-time remain affected.

CVE-2026-98432 is a race condition in the Linux kernel’s IPv4 TCP handshake that causes a use-after-free. The kernel CVE team published it on 15 Oct and scored it 9.8 (Critical): network-reachable, no credentials, no user interaction. All maintained stable kernels carry the fix. Oracle, SUSE and Amazon score it 8.1, citing high attack complexity. No exploitation in the wild is reported, and it is not in CISA’s KEV catalog. Anthropic says its AI model wrote a remote root exploit against servers with an MPTCP listener. Details are unpublished and unverified, and MPTCP is opt-in, though Go 1.24+ listeners use it by default.

Fixed: RHEL 8/9/10, Debian, Oracle Linux, Amazon Linux, most SUSE releases. Not fixed: Ubuntu (all releases), SLES 15 SP7, SUSE Micro 6.0/6.1.

Mitigation: install the fixed kernel and reboot. Meanwhile, inventory exposed Ubuntu, OpenShift and RHEL 9 real-time hosts, review MPTCP listeners, confirm net.ipv4.tcp_migrate_req is 0, and consider dropping inbound IPv4 options at the edge. No IoCs have been published.

4. Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

Red Hat has released fixed kernels for a use-after-free flaw in the Linux kernel’s IPv4 TCP code, covering RHEL 8, 9, and 10 (RHSA-2026:93414, 93412, 93413; a reboot is required). Ubuntu’s fixes for 22.04, 24.04, and 26.04 LTS remain in the opt-in -proposed channel, with no date for a regular update. Ubuntu 20.04, 18.04, and 16.04 have no fix yet.

Tracked as CVE-2026-98432, the bug has existed since Linux 4.4. Remote, unauthenticated attackers can trigger a race condition by sending connection requests with IPv4 options to any listening TCP port, potentially achieving remote code execution. The kernel CVE team and Red Hat, which raised its initial 5.9 rating, now score it 9.8. As a stopgap, Red Hat published an nftables rule dropping IPv4 TCP packets carrying options. It is incomplete and may break some workloads. Canonical says only updates are an adequate mitigation, not disabling MPTCP.

No attacks have been reported. Anthropic said an unreleased research model built a working root exploit; the code is unpublished. Debian, Oracle Linux, SUSE, and Amazon Linux have shipped fixes.

5. Critical Langflow Flaws Enable Authentication Bypass and RCE

IBM patched critical vulnerabilities in Langflow, an open-source framework for building AI agents, LLM workflows, and RAG systems. The flaws could allow authentication bypass, API credential leaks, and arbitrary code execution.

Popular in enterprises for its no-code visual interface, Langflow has been exploited in the wild to steal credentials, most recently in August.

The update fixes four flaws. Two are rated critical (CVSS 9.8): CVE-2026-93680, an incomplete fix for an auto-login issue that enables authentication bypass, and CVE-2026-110186, which allows unauthenticated remote code execution via Model Context Protocol (MCP) tool enumeration. CVE-2026-110193 (high) permits code execution through a third-party library but requires a low-privileged account. CVE-2026-110192 (CVSS 6.5) exposes poorly protected API credentials.

Versions 1.0.0 to 1.12.8 are affected; the fix is in 1.13.0 (PyPI and Docker). IBM urges users to back up the database, secret key, and uploaded files before upgrading. It also patched three medium-severity flaws in Hono, a framework used inside Langflow; users should upgrade to Hono 4.13.5.

6. Hackers Exploit WordPress RCE Flaw as Wordfence Blocks Over 60,000 Attacks in 24 Hours 

Hackers are actively exploiting an unauthenticated remote code execution vulnerability in WordPress Core, targeting a brief exposure window during software updates. Wordfence blocked 58,693 attacks in 24 hours, though these were attempts, not confirmed compromises.

Tracked as CVE-2026-119977 (CVSS 8.1), the flaw affects WordPress 4.7 through 7.1.3. During full-package Core upgrades, vulnerable sites unpack files into predictable directories under wp-content/upgrade. An unauthenticated attacker who reaches the staged setup-config.php at the right moment can potentially achieve PHP code execution on the server.

The exploit window lasts only seconds, so attackers poll repeatedly. Wordfence reported over 18,500 requests to staged installer paths in the first 21 hours.
WordPress 7.1.4, released October 28, 2026, fixes 22 vulnerabilities, including this one, by randomizing staging directories and blocking unsafe configuration promotion. Wordfence’s firewall rule reached paid customers immediately; free users get it November 27.

Site owners should update to 7.1.4 or a patched branch release via Dashboard > Updates, then check for unexpected administrator accounts, plugins, and suspicious PHP files. Firewalls and scans complement patching but cannot prove earlier exploitation didn’t occur.