SANS Stormcast Monday, November 2nd, 2026: OneNote Bulk Extraction; Trojanized Claude Code Extension in Cursor Marketplace; Ivanti Connect S

From SANS Stormcast: Daily Cyber Security News · 5:46

Show by Johannes Ullrich

Didier Stevens adds bulk JSON extraction to his OneNote analysis tool, a trojanized Anthropic Claude Code extension in the Cursor VS Code Extension Marketplace installs an SSH backdoor, Ivanti patches two more exploited Connect Secure zero-days, an Android "SMS of Death" proof of concept is public, and a Linux kernel Multipath TCP (MPTCP) mitigation update.OneNote File ExtractionDidier Stevens added a --jsonoutput option to his onedump.py tool, so embedded attachments from many OneNote (.one) files can be extracted in one run instead of one file at a time. Combined with myjson-filter.py, all embedded files are written to disk named by their SHA-256 hash.https://isc.sans.edu/diary/OneNote%20File%20Extraction/33478Trojanized Claude Code Extension in Cursor's MarketplaceMalicious versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension for Windows and macOS were available in the Cursor VS Code Extension Marketplace on October 29; they were not built by Anthropic. The extension adds an attacker SSH key, installs persistence, and tries to open a reverse SSH tunnel (that step fails on most hosts without admin rights). Cursor shut down the marketplace during cleanup and published indicators of compromise and detection and remediation scripts.https://cursor.com/blog/claude-code-extension-security-noticeIvanti Connect Secure Update and Exploit DetailsIvanti updated its October 13 Connect Secure advisory (CVE-2026-104935, authentication bypass) with fixes for two more vulnerabilities exploited in the same chain: CVE-2026-111357, missing authentication for a critical function allowing escalation to root (CVSS 8.8), and CVE-2026-118527, file uploads to predictable locations. Volexity describes how the three zero-days were chained for unauthenticated root code execution; update to 25.1.1.3 or 22.8R2.6 even if you patched on October 13.https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_UShttps://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/SMS of DeathA working proof of concept is now public for the "SMS of Death": a single malformed Wireless Application Protocol (WAP) Push SMS crashes com.android.phone, dropping active calls with no user interaction. Google fixed this denial of service in the October 2026 Android security update for Android 14 through 17.https://smsofdeath.comLinux Multipath TCP Vulnerability UpdateA follow-up on Friday's Linux kernel remote code execution flaw (CVE-2026-98432): the demonstrated exploit needs Multipath TCP enabled and a listening socket. Many distributions have shipped kernel updates; until you can patch, setting the sysctl net.mptcp.enabled=0 disables MPTCP.https://aws.amazon.com/security/security-bulletins/2026-160-aws/My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich

More episodes of SANS Stormcast: Daily Cyber Security News

More episodes

PodSearch is a free, independent podcast search engine. Read about PodSearch, the privacy policy or contact us.