Tech Pulse: Linux Zero-Day, Cursor Hack & Bedrock Previews
Oct 31 Daily: Linux MPTCP root flaw revealed, fake Cursor extension backdoored, AWS Bedrock previews live apps, and Apple iOS 27.3 lands China beta.
Top Highlights
- • Linux Kernel Root Exploit: Critical zero-day flaw in MultiPath TCP allows remote unauthenticated root compromise across servers.
- • Cursor Extension Supply Chain Attack: Rogue Anthropic Claude extension on Cursor and OpenVSX exfiltrated developer prompts for nearly 12 hours.
- • AWS Bedrock Interactive Web Previews: AgentCore runtime introduces real-time browser sandboxes to build, render, and debug agent web apps live.
- • Apple Intelligence Launching in China: iOS 27.3 enters beta next week with Alibaba Qwen and Baidu integration for regulatory approval.
- • Northflank Build Runner Breach: Developer platform forces immediate global token rotation after attackers compromised worker containers.
Critical Linux Kernel Flaw Enables Remote Root Compromise on MPTCP Servers
A critical vulnerability in the Linux kernel MultiPath TCP (MPTCP) subsystem has triggered emergency patching across major Linux enterprise distributions. Disclosed as CVE-2026-38294, the flaw allows unauthenticated remote attackers to achieve arbitrary root code execution.
The vulnerability occurs within net/mptcp/protocol.c during subflow socket creation and options parsing. Flawed boundary validation allows crafted packets to overflow slab memory structures, overwriting socket function pointers with kernel ring-0 supervisor rights.
Security teams recommend immediately upgrading to Linux 6.18.4, 6.12.18, or 6.6.94. For systems unable to reboot immediately, administrators can disable MPTCP at runtime using sysctl -w net.mptcp.enabled=0.
Anthropic Claude Extension on Cursor Backdoored in Supply Chain Infiltration
A trojanized Anthropic Claude extension was discovered on the Cursor marketplace and OpenVSX registry, operating undetected for nearly 12 hours. The package mimic official Anthropic developer branding while covertly exfiltrating developer prompts.
Analysis revealed an obfuscated JavaScript module hooking into editor context feeds to scan for API keys, SSH keys, and cloud secrets. Stolen credentials and code snippets were encrypted and transmitted to attacker-controlled endpoints.
Cursor and OpenVSX have permanently revoked the package and publisher certificates. Engineering organizations are urged to audit installed plugins, rotate all exposed API credentials, and enforce private verified extension registries.
Northflank Cloud Platform Forces Global Token Rotation Following Infrastructure Intrusion
Developer cloud platform Northflank disclosed a security breach after threat actors broke out of an ephemeral build runner container. The intrusion compromised worker host memory where project environment variables were temporarily processed.
While customer production databases and running workloads in isolated VPC networks were untouched, build-time tokens were exposed to risk. Northflank immediately terminated the affected worker fleet and rotated all customer session tokens globally.
Users are advised to rotate external API tokens, GitHub deploy keys, and database passwords passed into build commands. Northflank is accelerating adoption of gVisor and microVM sandboxing to isolate all future untrusted build tasks.
Amazon Bedrock AgentCore Adds Live Interactive Web App Previews in Sandbox Runtimes
Amazon Web Services has launched live interactive web application previews within the Amazon Bedrock AgentCore runtime. The capability allows autonomous AI coding agents to build, render, and debug web applications inside ephemeral cloud containers.
An integrated WebSocket streaming bridge delivers the container's virtual display directly to the AWS developer console. Developers can interact with generated React, Next.js, and Node applications in real time without local setup.
Crucially, the headless browser runtime captures console errors and visual layout issues, streaming them back to the agent for closed-loop autonomous bug fixing. Each sandbox runs within isolated Firecracker microVMs with strict IAM boundaries.
Apple Confirms iOS 27.3 Beta Bringing Apple Intelligence to China via Alibaba Partnership
Apple has officially announced that Apple Intelligence will launch in mainland China with iOS 27.3. A developer beta will arrive on November 4th ahead of a nationwide public rollout scheduled for December.
To comply with Chinese regulatory standards, Apple partnered with Alibaba to integrate localized Qwen large language models alongside Baidu search integrations. The release introduces notification summaries, visual intelligence, and photo object cleanup.
The rollout represents Apple's most crucial geographic expansion for its AI suite, designed to protect iPhone market share against domestic Chinese smartphone competitors integrating localized agentic capabilities.
Salesforce Deepens Defense AI Footprint with Reported $375 Million Acquisition of Rune
Enterprise software provider Salesforce has agreed to acquire defense AI startup Rune for approximately $375 million. The acquisition accelerates Salesforce's expansion into federal defense procurement and military logistics.
Rune develops autonomous AI agent orchestration platforms that coordinate supply chains, predict equipment maintenance, and route cargo fleets through contested operational environments under degraded network conditions.
Salesforce will integrate Rune's algorithms into its Missionforce platform and Agentforce engine, competing directly against Palantir Technologies and Anduril Industries for multi-million-dollar defense modernization contracts.
Intel Stock Tumbles as Datacenter AI Hardware Spending Pressures PC Component Margins
Intel shares tumbled more than 14% following Q3 earnings, wiping an estimated $12 billion in valuation from the US government's CHIPS Act equity stake. Weak client PC guidance drove the market sell-off.
Hyperscalers are diverting massive semiconductor supply toward High-Bandwidth Memory (HBM) and AI accelerators, causing DDR5 component bottlenecks. These shortages inflated component costs for PC manufacturers, dampening processor volume demand.
Intel confirmed that its flagship 18A process node remains on schedule for external customer production. However, substantial commercial foundry revenue is not projected until late 2027 as restructuring efforts continue.
Tech Pulse Daily
Get tomorrow's pulse first
Join engineers who read Tech Pulse before stand-up. Free, weekday mornings.
Author
Dillip Chowdary
Writes Tech Bytes coverage of AI, engineering, and the tools that actually ship. Editor of Tech Pulse Daily.