Cyber and AI Brief: 31 October 2026

Download full research (TXT, .txt) — complete independent Markdown-formatted research with 20 dated developments, eight deep assessments, twelve tracked items, evidence grades, operational recommendations and original external sources.

Research cutoff: 31 October 2026, 08:49 EDT (America/Toronto). Public-source synthesis only; no independent exploit reproduction or model benchmarks.

Three immediate security priorities

Linux kernel: demonstrated remote root with an MPTCP listener

Anthropic’s original research reports an unauthenticated root-level proof of concept for CVE-2026-98432 on Linux systems with MPTCP listeners. This is no longer only a theoretical denial-of-service concern. In-the-wild exploitation is not established, and remote code execution without MPTCP has not been publicly demonstrated. Verify the running kernel, actual listener reachability and distribution fixes, including on RHEL/OpenShift.

Ivanti: new KEV entries in an exploited appliance chain

The Canadian Cyber Centre’s October 30 update confirms CVE-2026-111357 and CVE-2026-118527 were added to CISA KEV. Patch applicable appliance branches and investigate possible persistence and downstream identity exposure.

Cursor: malicious developer extension

Cursor’s notice and Microsoft’s analysis describe a malicious Claude Code-branded extension served from Cursor’s marketplace on October 29. Affected installations require endpoint and credential checks; uninstalling the package alone may not remove SSH persistence.

Additional technical and business decisions

Alpine’s GitLab incident shows how a custom Ruby runtime can miss a critical fix. Drupal Commerce Core reports active access-bypass exploitation. Cisco Talos describes KeyDrift persistence in SD-WAN controllers.

Pluto Security’s investigation documents malicious model repositories that execute custom Python before inference. InfraDev shows how hidden tests reveal failures in AI-authored infrastructure changes. Polymarket’s incident postmortem illustrates third-party JavaScript risk to active financial sessions.

DigiCert’s October 30 guidance reiterates the March 2027 100-day public TLS limit; Let’s Encrypt plans a 64-day default in February 2027. Renewal must include validation, deployment and partner compatibility.

Complete evidence and action register

The standalone research TXT contains all 20 numbered items, eight deep assessments, twelve tracking items, evidence grades, original sources, technical mechanisms and executive actions.