Tech Pulse: Linux Zero-Day, Cursor Hack & Bedrock Previews

A critical vulnerability in the Linux kernel MultiPath TCP (MPTCP) subsystem has triggered emergency patching across major Linux enterprise distributions. Disclosed as CVE-2026-38294, the flaw allows unauthenticated remote attackers to achieve arbitrary root code execution without requiring valid credentials or established application sessions.

The vulnerability occurs within net/mptcp/protocol.c during subflow socket creation and options parsing. Flawed boundary validation allows crafted packets to overflow slab memory structures, overwriting socket function pointers with kernel ring-0 supervisor rights.

Security teams recommend immediately upgrading to Linux 6.18.4, 6.12.18, or 6.6.94. For systems unable to reboot immediately, administrators can disable MPTCP at runtime using sysctl -w net.mptcp.enabled=0.

A trojanized Anthropic Claude extension was discovered on the Cursor marketplace and OpenVSX registry, operating undetected for nearly 12 hours. The package mimicked official Anthropic developer branding while covertly exfiltrating developer prompts and local environment secrets.

Analysis revealed an obfuscated JavaScript module hooking into editor context feeds to scan for API keys, SSH keys, and cloud secrets. Stolen credentials and code snippets were encrypted and transmitted to attacker-controlled endpoints disguised as routine telemetry pings.

Cursor and OpenVSX have permanently revoked the package and publisher certificates. Engineering organizations are urged to audit installed plugins, rotate all exposed API credentials, and enforce private verified extension registries.

Developer cloud platform Northflank disclosed a security breach after threat actors broke out of an ephemeral build runner container. The intrusion compromised worker host memory where project environment variables were temporarily processed during build cycles.

While customer production databases and running workloads in isolated VPC networks remained untouched, build-time tokens were exposed to risk. Northflank immediately terminated the affected worker fleet and rotated all customer session tokens globally.

Users are advised to rotate external API tokens, GitHub deploy keys, and database passwords passed into build commands. Northflank is accelerating adoption of gVisor and microVM sandboxing to isolate all future untrusted build tasks.

Amazon Web Services has launched live interactive web application previews within the Amazon Bedrock AgentCore runtime. The capability allows autonomous AI coding agents to build, render, and debug web applications inside ephemeral cloud containers.

An integrated WebSocket streaming bridge delivers the container's virtual display directly to the AWS developer console. Developers can interact with generated React, Next.js, and Node applications in real time without local setup.

Crucially, the headless browser runtime captures console errors and visual layout issues, streaming them back to the agent for closed-loop autonomous bug fixing. Each sandbox runs within isolated Firecracker microVMs with strict IAM boundaries.

Apple has officially announced that Apple Intelligence will launch in mainland China with iOS 27.3. A developer beta will arrive on November 4th ahead of a nationwide public rollout scheduled for December.

To comply with Chinese regulatory standards, Apple partnered with Alibaba to integrate localized Qwen large language models alongside Baidu search integrations. The release introduces notification summaries, visual intelligence, and photo object cleanup.

The rollout represents Apple's most crucial geographic expansion for its AI suite, designed to protect iPhone market share against domestic Chinese smartphone competitors integrating localized agentic capabilities.

Enterprise software provider Salesforce has agreed to acquire defense AI startup Rune for approximately $375 million. The acquisition accelerates Salesforce's expansion into federal defense procurement and military logistics.

Rune develops autonomous AI agent orchestration platforms that coordinate supply chains, predict equipment maintenance, and route cargo fleets through contested operational environments under degraded network conditions.

Salesforce will integrate Rune's algorithms into its Missionforce platform and Agentforce engine, competing directly against Palantir Technologies and Anduril Industries for multi-million-dollar defense modernization contracts.

Intel shares tumbled more than 14% following Q3 earnings, wiping an estimated $12 billion in valuation from the US government's CHIPS Act equity stake. Weak client PC guidance drove the market sell-off.

Hyperscalers are diverting massive semiconductor supply toward High-Bandwidth Memory (HBM) and AI accelerators, causing DDR5 component bottlenecks. These shortages inflated component costs for PC manufacturers, dampening processor volume demand.

Intel confirmed that its flagship 18A process node remains on schedule for external customer production. However, substantial commercial foundry revenue is not projected until late 2027 as restructuring efforts continue.