Daily Brief
Linux kernel root flaw and poisoned Cursor extension
Critical Linux kernel flaw allows remote root attacks on MPTCP servers
Anthropic researchers developed an exploit for a critical Linux kernel flaw that can let unauthenticated attackers run commands as root on servers running Multipath TCP listeners. It matters because the issue can lead to full compromise of exposed Linux systems.
Identify any Linux servers running MPTCP listeners and prioritise patching or exposure reduction before the end of the week.
Malicious Claude Code extension on Cursor planted SSH backdoors
A malicious Claude Code extension was distributed through Cursor's marketplace for about 11 hours and was designed to install persistent SSH backdoors, exposing up to 5,000 developers. It matters because a trusted developer tool channel was used to seed long-lived access on affected systems.
Review extension installs from Cursor around the reported window and remove any suspicious Claude Code packages, then rotate SSH credentials where needed.