October 31, 2026. Security Practitioner Briefing. Four items: prioritize Linux and GitLab exposure checks, then investigate matching Cursor extension installs and review AD CS controls.
The Linux flaw has a researcher-demonstrated remote-root path under specific conditions; retrieved reporting says exploitation in the wild isn’t confirmed. GitLab’s critical-rated flaw is in CISA’s KEV catalog; Alpine reported an attack attempt but couldn’t rule out code execution. Malicious Cursor extension versions were available for hours October 29: investigate installs, not assume access. Microsoft describes two observed help-desk impersonation intrusions involving AD CS certificate abuse. Check builds and evidence first; treat the final item as a control and hunting review unless telemetry indicates activity.
Sources checked through Oct 31, 4:41 AM PDT. Published Oct 31, 5:30 AM PDT.
Affected technology Linux servers running affected kernel code, with particular urgency for reachable MPTCP listeners · Self-managed GitLab CE/EE installations in affected version ranges, especially custom builds or containers with their own Ruby runtime · Windows and macOS systems that installed Cursor marketplace versions 2.1.312 or 2.1.313 during the October 29 exposure window · Organizations using Microsoft Teams for support and Active Directory Certificate Services (AD CS)
Item one. Linux network-stack exposure: check the running kernel and MPTCP listeners
Item one. Linux network-stack exposure: check the running kernel and MPTCP listeners. Multipath TCP, or MPTCP, lets one connection use multiple network paths. CVE-2026-98432 is a use-after-free in IPv4 TCP handling: a race can leave code using freed memory. The Linux kernel CVE team assigned 9.8 severity; Red Hat rates the impact lower because exploitation is complex.
The vulnerable code dates back to kernel 4.4. Anthropic researchers demonstrated unauthenticated remote code execution as root on a server with an MPTCP listener. Ordinary TCP is also affected, but remote code execution hasn’t been publicly demonstrated without that listener. Reporting says there are no confirmed in-the-wild exploits. Some Go services built with Go 1.24 or later may enable MPTCP listeners by default when supported by the kernel.
Inventory running kernels and distribution packages, then check services—including Go services—for MPTCP listeners. Disabling MPTCP alone doesn’t fix the TCP flaw. Upstream fixes have been backported, but availability varies by distribution. Check the current distribution advisory, deploy its supported fixed kernel, and verify the running kernel after reboot. Until then, validated interim guidance or access restrictions may reduce exposure; neither replaces a fix.
Item two. GitLab CI/CD processing: patch GitLab and validate its Ruby runtime
Item two. GitLab CI/CD processing: patch GitLab and validate its Ruby runtime. GitLab runs automated build and test jobs called CI/CD pipelines. CVE-2026-97229 is an integer-overflow flaw in its regular-expression compiler. A crafted expression in CI/CD configuration could allow an unauthenticated user to execute code on the server. GitLab rates it critical, CVSS 10.0; CISA added it to KEV October 29.
Affected ranges are versions before 19.2.8, 19.3.5 and 19.4.2 within those branches. GitLab says GitLab.com and Dedicated tenants were patched; that doesn’t establish the status of self-managed instances. The flaw involves Ruby’s Onigmo engine. Alpine reported an attack attempt on October 20 and 21. Its checks found no tampering in packages and releases, but it couldn’t rule out code execution and was still testing its GitLab instance. Alpine also says upgrading GitLab alone didn’t fix its custom image, which used standard Ruby.
Inventory self-managed GitLab versions, deployment types and the Ruby runtime actually in use. GitLab names 19.2.8, 19.3.5 and 19.4.2 as fixed; Alpine says custom deployments also need patched Ruby. Follow guidance for your build and verify both components. For systems exposed before patching, review available CI/CD, host and network evidence for crafted configuration, worker crashes, unexpected processes or outbound activity. Treat detections as leads, not proof. Document logging gaps; missing telemetry isn’t clearance.
Item three. Cursor extension marketplace: scope installs, preserve evidence, check persistence. Cursor is a code editor that supports Visual Studio Code extensions; Claude Code is a coding-assistant extension. Cursor says modified versions 2.1.312 and 2.1.313 were available for Windows and macOS from about 2:27 a.m. to 1:35 p.m. Pacific time October 29. Microsoft says the malicious loader ran when the extension loaded, before its expected code.
The loader attempted to collect host details, add an attacker-controlled SSH key, enable local SSH, open a reverse tunnel and create startup persistence. Successful access depended on host privileges, SSH configuration and the attacker’s server. Cursor says SSH enablement would fail on most hosts without unusual administrator privileges; Microsoft says keys or persistence could still be written even if tunnel access failed. An installation warrants investigation, not an assumption of successful access.
Use extension-install records to scope the package, source, systems and exposure window. Preserve evidence before cleanup. Correlate endpoint, network, process and authentication telemetry with vendor indicators, including the `svc-telemetry` key label and reported persistence artifacts. Treat matches as leads and inspect their content and behavior. Isolate hosts with evidence of loader execution or backdoor installation; remove confirmed artifacts using vendor guidance. Uninstalling may not remove files outside the extension directory. Base credential rotation or session revocation on findings, then verify unauthorized keys, tunnels and persistence don’t return after restart. The sources don’t establish an install or compromise count.
Item four. Help-desk remote access and AD CS: review certificate paths and identity evidence
Item four. Help-desk remote access and AD CS: review certificate paths and identity evidence. Active Directory Certificate Services (AD CS) issues certificates used to authenticate users and machines. Microsoft’s October 30 report describes two intrusions that began with Teams contacts impersonating IT or help-desk staff. Users approved remote access, primarily through Quick Assist; attackers staged tools, explored systems and assessed AD CS. This isn’t a Teams vulnerability or evidence that your organization is affected.
The cases diverged at certificate services. In one, an ESC1-vulnerable template let an attacker request authentication certificates for privileged accounts. In the other, PetitPotam coerced a domain controller to authenticate; the attacker relayed that authentication to a Web Enrollment service without sufficient relay protections and obtained a certificate for the domain-controller identity. That certificate supported certificate-based Kerberos authentication. Password resets or rebuilding the initial workstation may not revoke issued certificates or existing Kerberos tickets.
Review whether templates allow requester-supplied identity information or broad enrollment, and whether Web Enrollment endpoints have relay protections. Correlate Teams and remote-support records with endpoint process lineage, certificate requests and issuance, domain-controller authentication, and Kerberos activity. A support call or portable runtime alone isn’t proof; examine the sequence and identity-to-source relationships. Microsoft reports that an excluded privileged account remained usable in one case and later supported data exfiltration. In the other, the customer isolated the associated workstation after alerts and observed no further progression. If evidence shows a relevant certificate or identity path, investigate issued certificates, privileged accounts and active tickets beyond the first workstation. Document telemetry gaps, remediate applicable configurations using Microsoft guidance, and verify any containment exclusion has a completed compensating action.
Other roles and original sources are linked below. Subscribe for your next briefing, and like it if this helped.
