Developer Security News: PHP2Shell, a Fake Claude Code Extension, Black October and a Linux TCP Bug

The last two weeks of October 2026 were rough for anyone who builds or hosts software. PHP shipped emergency fixes for two critical bugs that are now being exploited, a fake version of a popular AI coding extension appeared in an editor marketplace, at least nine AI developer platforms reported breaches, and a critical Linux kernel bug in TCP handling is still waiting for patches on some distributions.

If you run a PHP site, use AI coding tools, or manage a Linux server, at least one of these stories affects you. Below is a plain-English summary of each one, what you should check, and links to the official sources so you can confirm the details yourself.

1. PHP2Shell: Update PHP Now If You Have Not Yet

On October 21, the PHP project released emergency updates for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, together nicknamed "PHP2Shell." According to BleepingComputer's report, the flaws were found by researchers from Calif, OpenAI and Wiz, and both come from the same root problem: PHP can leave its memory in a corrupted state when a request ends abnormally.

What makes this serious is that the bugs affect all PHP installations that serve web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The PHP team said it considers mod_php the highest risk, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. In other words, a perfectly written PHP application can still be exposed.

The US Cybersecurity and Infrastructure Security Agency (CISA) added both CVEs to its Known Exploited Vulnerabilities catalog on October 26, which means it has evidence of real attacks.

What to do:

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your Linux distribution's patched package), then restart every PHP worker, such as PHP-FPM or your web server.
• Check the version your web server actually uses, not just the command line. Create a temporary page with <?php echo PHP_VERSION;, open it once, and then delete it.
• PHP 8.1 and older no longer get official releases. The PHP team published minimal source backports for 7.4, 8.0 and 8.1, but the real fix is moving to a supported version.
• If you use shared hosting, ask your provider which PHP build your account runs. Local tools like XAMPP and Laragon are much less exposed if they are not reachable from the internet, but it is still a good time to update them.

2. A Fake Claude Code Extension Appeared in Cursor's Marketplace

On October 29, Cursor published a security notice about maliciously modified versions of Anthropic's Claude Code extension (Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS) that were available in the Cursor VS Code Extension Marketplace for about eleven hours that day. Cursor says these versions were not built by Anthropic.

According to Cursor, the tampered extension collected host and user details (hostname, username, Git email, public IP and the names of environment variables), tried to add an attacker's SSH key labeled svc-telemetry to authorized_keys, tried to open a reverse SSH tunnel, and installed persistence through a LaunchAgent on macOS or a scheduled task named SysMon on Windows. Cursor notes that enabling the SSH service needs admin rights, so on most machines that step failed, and the attacker's server has since been taken offline. It still recommends cleanup, because uninstalling the extension alone may leave the persistence scripts running.

Independent checks by Socket found no record of version 2.1.313 on Open VSX, npm or Microsoft's marketplace, and an Anthropic engineer stated that it was never published on any official channel. The next official release was numbered 2.1.314 to avoid confusion.

What to do: if you use Cursor and installed or updated the Claude Code extension on October 29, follow Cursor's notice. On macOS or Linux, this quick check from the notice tells you whether the attacker's key was added:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

If the key is found, use Cursor's remediation script for your platform and rotate any credentials that were reachable from that computer.

3. "Black October": Nine AI Developer Platforms Breached

On October 30, Wiz published "Black October" for AI Developer Platforms, connecting a string of incidents that were each reported separately. Wiz lists at least nine platforms that disclosed incidents during October: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank.

Wiz says there is no single vulnerability linking the attacks, but the pattern is the same: attackers went after stored environment variables, especially API keys for AI models. Stolen keys are then resold or used to run up huge bills, a practice known as "LLMJacking." In two cases Wiz traced, the first use of a stolen key came within 30 minutes of the reported credential theft. One key was used for about 800,000 Amazon Bedrock calls over 30 hours, another for about 1.7 million calls over 13 hours, and Wiz estimates the two cases alone likely ran up more than $100,000 at list price.

What to do:

• If you use any of the listed platforms, read their incident notices and rotate the keys you stored there. Northflank, for example, told customers to assume their environment variables were decrypted.
• Set spending limits and usage alerts on every AI provider account. A limit turns a stolen key from a disaster into an annoyance.
• Give each project its own key with the smallest permissions it needs, so one leak does not expose everything.
• Never commit .env files or API keys to Git, even in private school repositories. Add .env to your .gitignore before your first commit.

4. CVE-2026-98432: A Critical Linux TCP Bug

The fourth story is for anyone who manages a Linux server or VPS. CVE-2026-98432 is a use-after-free bug in the Linux kernel's IPv4 TCP connection handling. The kernel CVE announcement says it was introduced in Linux 4.4, so it affects a very wide range of systems, and it was fixed in 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7.

Red Hat rates it Critical and explains that a remote, unauthenticated attacker could exploit a race condition during TCP connection setup to achieve remote code execution, although exploitation requires precise timing. AWS's bulletin adds that researchers have demonstrated remote code execution against hosts with a Multipath TCP (MPTCP) listener, and that AWS is not aware of exploitation in the wild. Amazon Linux kernels with the fix are already available.

Not every distribution has a fix yet. When we checked on November 2, Ubuntu's CVE page still listed its kernels as vulnerable with fixes "work in progress," and AlmaLinux had patched kernels in testing.

What to do:

• Run uname -r to see your kernel version, and watch your distribution's security page for the fixed package.
• When the update arrives, install it and reboot. A kernel fix does nothing until the server runs the new kernel.
• Until then, Red Hat and AWS both describe temporary firewall rules that drop incoming IPv4 TCP packets carrying IP options, and AWS suggests disabling MPTCP with net.mptcp.enabled=0. These reduce the risk but are not a full fix, so test them before using them in production.

Quick Release Watch

• PHP 8.6: The final release candidate, RC5, is planned for November 5, 2026, according to the PHP news archive. The PHP team says RC4 also contains fixes for two critical remote code execution vulnerabilities, so anyone testing an earlier 8.6 build should update.
• Python: Python.org now lists Python 3.10 as end-of-life, and the newest stable release is Python 3.15.2 (October 25). If a school project or server still runs 3.10, plan the upgrade.

The Common Thread

Look at these four stories together and one lesson stands out: attackers go after the things developers trust by default. That means the language runtime under your code, the extensions inside your editor, the platforms that hold your API keys, and the operating system under your server. None of these attacks required a bug in the victim's own application code.

You do not need a security team to protect yourself. Keep runtimes and kernels updated, install extensions only from publishers you trust and watch for unusual version jumps, keep secrets out of your code, and set spending limits on anything that bills by usage. If you want a simple place to start, our guide on finding vulnerable dependencies with npm audit, pip-audit and composer audit shows how to check your projects in a few minutes.

Stay safe, and happy coding!