> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Semgrep Guardian incident advisories

> See which security incidents Semgrep Guardian checks for on your machine, and how to turn off a check.

When Semgrep's Security Research team finds a critical, actively exploited vulnerability or a compromised developer tool that affects developer machines, Semgrep releases a Semgrep Guardian check for it. The check runs inside your coding agent. If your machine is affected, Guardian shows a message that names the issue and how to fix it, such as the version to upgrade to. Guardian doesn't change your installed software for you, but you can ask your agent to follow the remediation advice.

## Covered incidents

The following table lists each incident that Guardian checks for, with its Common Vulnerabilities and Exposures (CVE) IDs where they exist:

| Incident | What Guardian checks | Vendor advisory | Disclosed | Guardian check released |
| :- | :- | :- | :- | :- |
| **Compromised Claude Code extension on the Cursor Marketplace** | Whether the Claude Code for VS Code extension 2.1.313 is installed in any editor, or your machine shows signs of the SSH backdoor it installs, which lets an attacker sign in to the machine. Uninstalling the extension doesn't remove the backdoor. | [Cursor security notice](https://cursor.com/blog/claude-code-extension-security-notice) | October 29, 2026 | October 30, 2026 (Guardian 2.10.20) |
| **Node2Shell (Brotli2Shell)**, CVE-2026-111497 | Whether your local Node.js version is affected by the Brotli decoder remote code execution vulnerability | [Node.js October 21, 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high) | October 21, 2026 | October 22, 2026 (Guardian 2.9.13) |
| **PHP2Shell**, CVE-2026-109618 and CVE-2026-109619 | Whether your local PHP version is affected by the remote code execution vulnerabilities | [PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) | October 21, 2026 | October 21, 2026 (Guardian 2.9.4) |

## How the checks run

Guardian runs these checks in the Claude Code and Codex plugins, once per coding session, on the first `Write`, `Edit`, `Bash`, `PowerShell`, or `apply_patch` call. If your machine is affected, Guardian blocks that call so you see the message. Later calls in the same session run normally. The checks run again when you start a new session.

If your machine isn't affected, Guardian shows no message.

For details about the PHP check, including the fixed release for each PHP branch, see [Local PHP version check](https://docs.semgrep.dev/semgrep-guardian/faq.md#local-php-version-check).

## Turn off a check

Each check has an environment variable that turns it off. Set the variable to `off` in the environment where you start your coding agent, then start a new session.

| Check | Environment variable |
| :- | :- |
| Compromised Claude Code extension | `SEMGREP_GUARDIAN_EXTENSION_CHECK` |
| Node2Shell | `SEMGREP_GUARDIAN_NODE_CHECK` |
| PHP2Shell | `SEMGREP_GUARDIAN_PHP_CHECK` |

For example, to turn off the Node2Shell check, run:

> [tab] macOS and Linux
>
> ```bash theme={null}
> export SEMGREP_GUARDIAN_NODE_CHECK=off
> ```

> [tab] Windows PowerShell
>
> ```powershell theme={null}
> $env:SEMGREP_GUARDIAN_NODE_CHECK = "off"
> ```

These commands set the variable for the current shell only. To keep the check off, add the command to your shell profile, such as `~/.zshrc`, `~/.bashrc`, or your PowerShell `$PROFILE`.

To confirm that the check is off, start a new session in your coding agent. Guardian no longer shows a message for that incident.

Turn off a check only if you've mitigated the issue another way.

## Incidents in your project dependencies

Guardian's incident checks cover software installed on your machine. To get notified when an incident affects the dependencies in your projects, use Semgrep Supply Chain. For more information, see [Supply Chain incident notifications and response](https://docs.semgrep.dev/semgrep-supply-chain/incident-notifications.md).