Cursor
India2 sources
Confirmed:Confirmed by the organisation, a regulator or a securities filing. First reported 30 Oct 2026.
Malicious Claude Code extension affects up to 5k Cursor users
A malicious version of Anthropic's Claude Code extension was found on Cursor's extension marketplace. Up to 5,000 users could have been affected and the marketplace was temporarily taken down.
- Type
- Cyberattack
- Sector
- Technology
- Records
- 5K records confirmed
- First reported
- 30 Oct 2026
- Latest source
- 31 Oct 2026
What to do
- Follow updates from the organisation itself rather than social media.
- If you have an account, change that password, and anywhere you reused it.
- Turn on two-factor authentication, ideally an authenticator app or passkey, not SMS.
- Expect phishing that uses your real details. Do not click links in messages about this incident; go to the company's site directly.
- If they are a supplier, ask for an incident summary and the indicators of compromise.
- Patch internet-facing systems first, especially VPNs, firewalls and file transfer software.
Not sure? Ask an assistant with the sources attached, or have a coding agent check your systems.
Check your systems for Cursor
Sources
2- timesnownews.com31 Oct 2026timesnownews.com/technology-science/from-au-small-finance-bank-breach-to-php-flaw-cyberattacks-in-october-that-took-the-internet-by-storm-article-156439134
- cybersecuritynews.com30 Oct 2026cybersecuritynews.com/hacktober-cyberattack-wave
Confidence 65% that this is real and correctly placed. Locations are city centroids at best. Spotted an error? Report a correction.