GLOBAL – October 30, 2026 -- A maliciously modified build of the Anthropic.claude-code extension, version 2.1.313, sat in the Cursor VS Code Extension Marketplace for about 11 hours on October 29, 2026, potentially exposing up to 5,000 users, according to Cursor. Anthropic did not develop the malicious version.

Global – October 27, 2026 -- A malicious version of the tensorlake npm package (0.5.144), which draws about 12,000 weekly downloads, was published carrying Shai-Hulud malware, according to OX Security.

Malware wipes the host if a stolen GitHub token is revoked

The payload contains a kill-switch string, IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner, identical to the one used in the TanStack attack in May. Revoking the stolen GitHub token triggers rm -rf ~/ on Unix systems or Remove-Item on the Windows user profile.

Global -- A malicious version of LiteLLM, version 1.107.0, was published to PyPI on October 21, 2026. It bundles a credential-stealing infostealer with a remote access trojan (RAT), according to OX Security. It is the second hijacking of the AI gateway this year, and PyPI has since quarantined the release.

Global – – October 19, 2026 -- The ShinyHunters extortion gang claims it has stolen data from 300 Oracle PeopleSoft instances across more than 100 organizations, BleepingComputer reported on 10 June 2026. The group says it is targeting both cloud and on-premises deployments of the enterprise suite, which large organizations use for HR, payroll, finance, supply chain, procurement and student administration.

Global – – October 19, 2026 -- Salesforce has disabled all Klue integrations after the threat group Icarus claimed on 19 June 2026 to have exfiltrated customer data through the market intelligence platform's Salesforce connection. Matching data points give high confidence that Icarus is behind the supply chain attack, according to the source analysis.

Global – October 17, 2026 -- ConnectWise is investigating attempted unauthorized access to its Cloud Backup for Microsoft 365 service, formerly SkyKick Cloud Backup, after disclosing the incident on October 16. The company says containment measures are in place and it has no indication that partner backup data was accessed. The investigation is ongoing.

Griffin -- Brightmoor Hospice, LLC began mailing breach notifications on October 16, 2026, after two employee email accounts were accessed without authorization and found to contain protected health information of certain patients.

Unauthorized access lasted two days in March 2026

Brightmoor discovered suspicious activity on or around March 25, 2026. Third-party specialists determined that the two accounts were accessed between March 24 and March 25, 2026. The company secured the accounts immediately and began reviewing their contents.