SOC Talk: The Log4Shell Vulnerability

On October 29, Cursor’s built-in marketplace served a tampered Claude Code extension to as many as 5,000 developers, planting an SSH backdoor that stays behind even after the extension is uninstalled. Here’s where each stage of the attack shows up in your logs, the Splunk searches we’d use to hunt for it, and why most SOCs can’t see developer laptops well enough to run them.

Our Splunk .conf26 recap covers AI in the SOC, keeping humans in the loop, AI governance and token costs, federated search, and AI as a security control plane.