October 31, 2026. Sales Engineer Briefing. Three customer conversations today. Start with Cursor customers whose developers installed a specific extension version during Thursday’s exposure window; attempted persistence can outlast uninstalling it.
Microsoft’s new analysis details a malicious Cursor marketplace extension and attempted SSH backdoors. A separate Linux kernel flaw has a lab-demonstrated remote-root path under specific conditions, with no confirmed in-the-wild exploitation reported. Microsoft also describes two help-desk impersonation intrusions that reached privileged identities through misconfigured certificate services. Each story is conditional; ask about customer architecture and evidence before claiming exposure. Other role editions are linked below.
Sources checked through Oct 31, 4:41 AM PDT. Published Oct 31, 5:30 AM PDT.
Affected technology Cursor customers whose developers installed or automatically updated Claude Code extension versions 2.1.312 or 2.1.313 through Cursor’s marketplace during the October 29 exposure window. · Customers running affected Linux kernels, especially where services use MPTCP listeners; remote root was demonstrated in a lab under specific conditions, not reported in the wild. · Organizations using Microsoft Teams, remote-support tools, and Active Directory Certificate Services configurations that permit the reported ESC1 or ESC8 certificate-abuse paths.
Item one. Cursor extension marketplace: identify the installed build and investigate the host
Item one. Cursor extension marketplace: first establish whether the customer installed the affected build. Cursor is a code editor that accepts Visual Studio Code extensions; Claude Code brings Anthropic’s coding assistant into that workflow. Cursor says malicious versions 2.1.312 and 2.1.313 were available in its marketplace from about 2:27 a.m. to 1:35 p.m. Pacific Time on October 29. Microsoft’s analysis, published October 31, adds detail; it is not a new exposure window.
The injected code ran when the extension loaded. It attempted to add an SSH key, enable local SSH, create an outbound reverse tunnel, and install persistence. That tunnel could give an attacker a route back into a developer workstation, but access depended on privileges, SSH configuration, and the attacker’s server. Cursor says the server was taken offline; Microsoft notes that key or persistence artifacts might still have been written even if tunnel access failed. Neither installation nor an artifact alone proves successful access. Cursor says it found no evidence that other versions or the official distribution were affected.
Ask whether developers installed or auto-updated to either version from Cursor’s marketplace during that window. Have the endpoint owner check extension records, SSH authorization files, startup persistence, and endpoint and network telemetry; preserve evidence before cleanup. Uninstalling alone may leave separate scripts behind, so the check helps determine whether cleanup or broader investigation is needed. Don’t promise an endpoint control prevented this without customer-specific evidence. Cursor’s security notice is the first read before a call.
Item two. Linux kernel networking: distinguish MPTCP listeners from Linux in general
Item two. Linux kernel networking: don’t describe this as every Linux server being remotely root-able. Multipath TCP, or MPTCP, lets one connection use multiple network paths. The Linux kernel team describes a use-after-free flaw in IPv4 TCP handling; Anthropic researchers demonstrated remote code execution as root on a server running an MPTCP listener. The issue also affects ordinary TCP, but remote code execution has not been publicly demonstrated without that listener. The kernel team rates it critical; Red Hat describes exploitation as complex and its potential impact as denial of service. The supplied reporting says no exploitation in the wild has been confirmed.
The practical customer question is whether an affected distribution kernel is running and a service actually has an MPTCP listener. Go 1.24 and later can enable MPTCP for Linux TCP listeners when the kernel supports it, so application owners may need to check service behavior rather than infer it from the operating system alone. Linux adoption is not a count of vulnerable or exposed servers.
Ask the Linux and application owners to verify the distribution advisory, installed kernel package, and listener configuration. Kernel fixes are upstream, but distribution package availability differs; update using the vendor’s supported package when available. That addresses the underlying flaw, while the configuration check helps judge interim exposure. Don’t claim disabling MPTCP alone resolves the issue: the kernel advisory’s concern is broader TCP handling.
Item three. Help-desk impersonation and AD CS: ask how support access becomes identity access
Item three. Help-desk impersonation and AD CS: Microsoft’s October 30 research describes two investigated intrusions, not a claim about a customer. Active Directory Certificate Services, or AD CS, issues certificates that can authenticate users and machines. In both cases, attackers impersonated support staff through Teams and persuaded users to grant remote access, primarily through Quick Assist. They then assessed certificate services.
The paths diverged. In one case, a misconfigured certificate template let an attacker request authentication certificates for privileged identities. In another, the attacker relayed a domain controller’s authentication to an AD CS web-enrollment service and obtained a certificate for that machine account. A certificate can create an authentication route that a password reset alone doesn’t remove. Microsoft reports DCSync and data exfiltration in the first case, where one privileged identity was excluded from automated containment; in the second, the customer isolated the workstation and no further progression was observed. These are case findings, not evidence of customer exposure.
Ask whether the customer uses Quick Assist or another remote-support workflow, and whether AD CS templates and web-enrollment endpoints have been assessed for ESC1 and ESC8 conditions. If the workflow or configuration resembles the report, involve identity and Windows infrastructure owners. Review certificate issuance, authentication, and containment exclusions; endpoint isolation or password resets alone may not address issued certificates or existing Kerberos tickets. Microsoft’s investigation is the source to read before explaining the distinction.
