Claude Code Extension Trojanized on Cursor Marketplace
Trojanized Claude Code extension on Cursor's marketplace pushed an SSH backdoor to 5,000 developers. Anthropic says its own systems weren't touched.
Rex spent fifteen years defending budgets in boardrooms before deciding he would rather write about them. He covers regulation, the business of security and the occasional unpopular opinion, always with the same question: what does this actually cost, and who pays?
He has opinions about vendor marketing that cannot be printed, believes most security spend is never measured, and ends every column with a verdict.
Trojanized Claude Code extension on Cursor's marketplace pushed an SSH backdoor to 5,000 developers. Anthropic says its own systems weren't touched.
A planted AGENTS.md in a developer's Downloads folder nearly made OpenAI's Codex install malware. The guardrails are cheap; most teams lack them.
Working exploit attempts are already circulating for two pre-auth RCE flaws in PHP's runtime. We price out patching, WAF rules and pulling the plug.
Calif chained a 37-year-old SysV integer overflow with an OOB write to get root on OpenBSD 7.9 past KARL, SMAP and SMEP — and the PoC is already public.