Homebrew Maintainer Slams Google Over Malicious Ads in Binance Supply Chain Breach

Polymarket Pays Out $3.9 Million After DebugBear Third-Party Script Compromise

Prediction market platform Polymarket has announced compensation totaling 3.9 million dollars to users affected by a malware incident involving a compromised third-party script. The malicious code was delivered through a performance monitoring script provided by DebugBear, which was injected into Polymarket.com and executed automatically for site visitors. Attackers used the script to target logged-in users, extracting trading positions from 726 wallets and transferring assets worth 2.7 million dollars to an attacker-controlled wallet. An additional 1.2 million dollars is being paid to owners of approximately 5,500 wallets that suffered losses due to the temporary trading suspension. Cybersecurity firm Hudson Rock identified DebugBear as the affected vendor. DebugBear later confirmed that attackers modified DNS records via the domain registrar, preventing email delivery during the incident. The attack was described as targeted at one specific customer website.

Malicious Claude Code Update 2.1.313 Distributed via Cursor Marketplace Infects Up to 5,000 Users

Security researchers at OpenSourceMalware discovered a trojanized version of the official Claude Code extension from Anthropic that was pushed as a legitimate update through the Cursor IDE marketplace. The malicious package, version 2.1.313, inserted a 66-line loader that added an attacker-controlled SSH key named svc-telemetry to ~/.ssh/authorized_keys, established a reverse tunnel to 134.209.82.225, deployed persistence mechanisms, and exfiltrated host metadata including IP address, hostname, username, OS details, Git email, and names of environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP. The campaign ran for roughly eleven hours on 29 October 2026 and was limited exclusively to the Cursor marketplace; no malicious versions appeared in Open VSX or the Microsoft VS Code Marketplace. Cursor responded by removing the package, rebuilding the marketplace, rotating keys, and disabling the attacker-controlled server at 134.209.82.225:8099. The company stated that at most 5,000 users installed the compromised update and committed to direct outreach while recommending isolation, SSH key removal, persistence cleanup, and credential rotation. The incident highlights supply-chain risks associated with automatic extension updates and the difficulty of detecting tampering when a legitimate publisher’s name and signing appear intact.

Malicious Claude Code Extension with SSH Backdoor Found in Cursor Marketplace Affecting Up to 5000 Users

A malicious version of the Claude Code extension was discovered in the Cursor extension catalog on October 29. The package, version 2.1.313, remained available for approximately 11 hours and could have impacted up to 5000 users. It was not developed by Anthropic and instead collected system information including IP addresses and Git email settings before installing an attacker-controlled SSH key. The extension attempted to establish remote access with persistence mechanisms, though some installations failed due to missing administrative privileges. Cursor responded by removing the package, auditing other extensions, and disabling the attackers' server. Users are advised to fully clean up residual scripts and rotate credentials from a trusted device rather than simply uninstalling the extension.