Tampered Claude Code extension requires cleanup beyond an update

Independent

According to Cursor, malicious extension version 2.1.313 was available through its marketplace for roughly 11 hours on October 29. The Register reports that it collected and forwarded host and user information, installed persistence and attempted a reverse SSH tunnel.

Why it matters: Affected engineering teams face remediation beyond replacing the extension because an update does not clear persistence. Cursor and Phorion reportedly found that missing administrator privileges prevented the tunnel from opening in most macOS and Windows cases. That limitation did not prevent the reported information transmission or persistence installation.

Decision: If developers installed the affected version, investigate their machines and consult Cursor's incident remediation guidance before treating cleanup as complete.

What remains uncertain: The article does not establish how the package entered the marketplace or how many tunnels succeeded. Anthropic denies compromise of its systems and says its official distribution channels were unaffected. These vendor statements are reported through the article; the underlying advisory and remediation scripts were not supplied.

Read: Reported article: Anthropic: That Claude Code extension compromise… couldn't be us

No linked primary source could be read; claims rely on the reporting above.

CISA identifies active exploitation of two Ivanti Connect Secure flaws

Regulator

CISA added CVE-2026-111357, involving missing authentication for a critical function, and CVE-2026-118527, involving predictable numbers or identifiers, to its Known Exploited Vulnerabilities Catalog on October 30, citing evidence of active exploitation.

Why it matters: For organizations running affected Connect Secure systems, the alert establishes that these flaws have been exploited. That supports prioritizing applicable remediation. The alert describes federal prioritization requirements for KEV vulnerabilities on publicly exposed assets that grant total control after exploitation, but does not establish whether either Ivanti flaw meets that condition.

Decision: If Connect Secure is deployed, determine whether installed versions are affected and prioritize remediation for affected systems.

What remains uncertain: The alert supplies no affected versions, exploitation scale or Ivanti-specific deadlines. The supplied catalog text concerns a different Linux vulnerability and cannot establish Ivanti obligations. The implementation-guidance fetch failed, so specific forensic requirements cannot be determined here. The directive applies only to Federal Civilian Executive Branch agencies.

Read: Primary source: CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA; Primary source: Known Exploited Vulnerabilities Catalog | CISA

GM agrees to $220 million driver-data settlement

Independent

The Register reports that GM agreed to a $220 million settlement with 35 states and Washington, DC over allegations of collecting and selling driving data without informed consent. Reported terms include collection limits, stronger protection of personal information and a comprehensive privacy program.

Why it matters: Investigators say brokers supplied the data to insurers that could use it to set premiums. They also say OnStar incorrectly showed more than 370,000 drivers as unenrolled while collection and sales continued. For connected-product leaders, this supports checking whether displayed enrollment status matches actual telemetry collection and distribution: customers were reportedly shown a status inconsistent with both.

Decision: For products distributing identifiable telemetry, verify that displayed enrollment status matches actual collection and broker transfers.

What remains uncertain: The settlement documents were not supplied; terms and investigative findings come through the article. It does not establish actual premium changes or the effectiveness of GM's remediation. Smart Driver ended in April 2024, so the settlement concerns historical conduct.

Read: Reported article: GM cracks the petty cash box for multistate driver tracking settlement

No linked primary source could be read; claims rely on the reporting above.