Resilience Is Not Optional: Lessons from Cursor, Microsoft 365, the FAA and Check Point
Four incidents in about two weeks, from a backdoored extension in Cursor's store to a nationwide US ground stop. Different causes, same weak spot - a trusted part with no fallback. Here is how they connect and the basics that keep a bad day from becoming a crisis.
The systems we depend on most are the ones we question least. Between late October and mid-November 2026, four of them failed almost back to back: a backdoored extension in Cursor’s official store, a Microsoft 365 outage that lasted more than a day, the FAA grounding every flight in the United States, and attackers taking over unpatched Check Point firewalls.
On paper they have nothing in common. One is a supply-chain attack, two are outages caused by upgrades, and one is a hacked security product. Look closer and each broke the same way: at a part everyone trusted and nobody had a fallback for. None of these organisations lacked tools, budget or talent.
This post walks through what happened, how the four connect, and the basics that stop a bad day from turning into a crisis.
Four incidents, one failure pattern
Tap an incident to see what broke. Tap a dashed line to see where two of them collided.
Cursor marketplace
- What happened
- A tampered Claude Code extension (2.1.312 / 2.1.313) was served from Cursor’s own extension store. Anthropic did not build it.
- Root cause
- Not disclosed. Likely: a stolen publishing token, a compromised release pipeline, or weak checks on mirrored packages.
- Impact
- Host details sent out; attacker SSH key, reverse tunnel and persistence planted.
Three of the four landed inside 48 hours
Every step had a basic control that breaks it
Cursor extension compromise
29 Oct 2026Poisoned release
2.1.312 / 2.1.313 appear in the Cursor store
Signed publishing
MFA, short-lived tokens, provenance checks
Auto-install
Up to 5,000 developers pull it in
Allowlist and pin
No silent updates for privileged tools
Recon and exfil
Host, user, Git email, env var names, IP sent out
Secrets in a vault
Nothing valuable in laptop env vars
SSH backdoor
Attacker key, reverse tunnel, persistence task
EDR and egress rules
Alert on new keys and reverse SSH
Check Point gateway takeover
30 Oct – 4 Nov 2026Exposed portal
Mobile Access online, patch not applied in a week
Edge patch SLA
Days, not weeks; unused portals off
PHP2Shell
CVE-2026-109618 and -109619 for a foothold
Restrict exposure
Management from trusted IPs only
Root on gateway
Zero-day CVE-2026-123039
Assume breach
Compromise check after every patch
Backdoor and wiper
TSGA, webshells; ESXi wiped in wave 1
Segment and back up
No path to ESXi; offline backups
Top row: what the attacker did. Green row: the basic control that would have stopped that step. The attacker needed every step to work; any one control breaks the chain.
Two outages, both caused by an upgrade
Microsoft 365
- Trigger: earlier network capacity upgrade
- Hit: Outlook, Teams, SharePoint, Copilot, Defender XDR
- Lesson: one platform means one blast radius, including your security console
FAA ground stop
- Trigger: ATC technology upgrade overloaded routers
- Hit: nearly 8,000 cancellations, 10,000+ delays
- Lesson: a backup on the same path fails with the primary
Bars show outage length on one scale.
Resilience is a loop, not a project
- Inventory assets, edge devices, SaaS and IDE extensions
- Patch internet-facing devices in days, not weeks
- Treat big changes as risk: canary, capacity test, rollback
- Sign and pin what you install
- EDR on developer laptops, not only servers
- Alerts on new authorized_keys and reverse SSH
- Watch vendor status pages and CISA KEV
- Runbooks with named owners and decision rights
- Out-of-band comms if email and chat are down
- Know how you respond if your security console is offline
- Immutable or offline backups, especially for ESXi
- Restores tested against real recovery targets
- Manual fallback workflows for critical processes
- A rehearsed mass credential rotation
- Post-incident review after every event
- Tabletop all four scenarios this quarter
- Report patch latency, restore success and rotation time to leadership
How resilient is your organisation?
Saved in this browser only.
Incidents can happen to anyone. Recovery is a choice.
These were some of the best-resourced organisations in the world, and they still had a bad fortnight. You cannot stop a vendor pushing a bad upgrade. You can control how fast you patch, how well you segment, whether your backups restore and whether your people know the plan.
Sources
- Cursor security notice
- GovInfoSecurity: Cursor confirms extension compromised
- Dark Reading: trojanized Claude Code extension
- Outlook India: Microsoft 24-hour outage
- CNN: Microsoft global outage
- Wikipedia: 2026 FAA nationwide ground stop
- CNN: US flights resume after ground stop
- Al Jazeera: why US flights were grounded
- Check Point security advisory
- BleepingComputer: Check Point gateways hacked
- The Hacker News: PHP2Shell in Check Point
- IT-Connect: patch-to-attack window
Facts as reported up to 15 November 2026. Microsoft and Cursor have not yet published full root-cause reports.
- Resilience
- Incident Response
- Supply Chain
- Opinion
Written by Deepak Kumar, CISSPEnterprise security leader, 20 years — Full profile →← Back to Blog