ezNet SolutionsManaged IT & cybersecurity
Threat Watch LiveChecking services…Contact us
Now watching
  • Checking services…
Watch level: ElevatedOpen Threat Watch →
Live · Watch level: Elevated

Threat Watch

Past picks.

Each week Bill picks the one threat small businesses should hear about. Here's every pick, newest first, as it was written at the time, with any later updates.

Current pick · · Action recommended

Fake Claude Code extension in Cursor left a back door

Why it matters
For about 11 hours on October 29, Cursor's extension store offered a tampered Claude Code extension (versions 2.1.312 and 2.1.313). It quietly added an attacker's key so they could get back into the computer later.
What we're doing
We're checking the computers we manage for Cursor and the affected versions. If your team uses Cursor on a computer we don't manage, we can check it for you.
What you should do
If anyone on your team uses Cursor, update the Claude Code extension and check the computer for SSH keys and startup items you don't recognize. Removing the extension alone doesn't remove the back door.

Read Microsoft's analysisLink to this pick

Picked · · Action recommended

PHP2Shell: older websites can be taken over

Why it matters
Two critical PHP flaws let attackers take over a website without logging in, and they're being used right now.
What we're doing
We're tracking this for every client and will contact you directly if a website you own is affected.
What you should do
If you have a WordPress, Joomla or custom PHP website, ask your web host to confirm it runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later.

Read our full noticeLink to this pick

Back to Threat Watch