backdoor - Thorsten Meyer AI

Reality Check

The Name Was Right, the Code Wasn’t: A Tampered Claude Code Update Reached Up to 5,000 Cursor Users. What to Check Now

A small brass key lying on a grey doormat in front of a closed white front door on a bright porch

For about eleven hours on 29 October, Cursor’s extension store offered a tampered Claude Code 2.1.313 under the real extension ID. It planted an attacker’s SSH key and tried to open a tunnel; a bug stopped the worst step on most machines. Cursor says at most 5,000 users were affected. The timeline, what each party says, why this attack class works, and the one check to run now.

Thorsten Meyer
October 30, 2026

View Post

Reality Check

Stolen UpdraftCentral Keys Are Backdooring WordPress Sites. The Fix Has a Gap.

A translucent glass master key floating in a blue sky above small white houses, with one thin orange thread of light reaching down to the ground

TeamUpdraft’s customer database leaked the UpdraftCentral Cloud keys that sign commands to connected WordPress sites. Attackers used them to install backdoor plugins on fully patched sites. UpdraftPlus 1.26.13 revokes keys created before midday on October 18, but not those from the hours that followed, and it does not remove backdoors that are already in place.