Today’s look-out: Supplier & SaaS risk plus website takeover attempts
What to look out for today
Three themes SMEs should pay attention to today:
- Software supply-chain risk via “trusted” marketplaces: a malicious version of a Claude Code extension was distributed via Cursor’s extension marketplace for around 11 hours, aiming to plant persistent remote access (SSH backdoors) on developer machines.
- Website takeover attempts at scale: reports of very high volumes of attack attempts against a recently patched WordPress Core remote-code-execution issue (large scanning activity often follows public patches).
- Actively exploited internet-facing platforms: CISA has added GitLab remote code execution and a Cisco firewall denial-of-service issue to its Known Exploited Vulnerabilities list, signalling observed exploitation in the wild.
Why this matters to smaller businesses
- Developer tools are business tools: even small teams using code editors, extensions and package managers can be exposed. A compromised developer laptop can lead to source code theft, credential theft, and wider network compromise.
- WordPress is common in SMEs: high scanning volume means even “small” sites get probed. A compromised site can be used for malware delivery, payment diversion, SEO spam, or as a stepping stone into email and customer data.
- GitLab and firewalls sit on critical paths: if you host GitLab or rely on an MSP/SaaS that does, exploitation can mean outages, data exposure, or a foothold for ransomware.
Warning signs
- Developer endpoints: unexpected prompts for credentials/keys, new background processes, unusual outbound connections, or changes to SSH configuration/authorised keys.
- WordPress sites: sudden admin logins, new administrator accounts, unknown plugins/themes appearing, strange redirects, unexpected changes to homepage content, or warnings from your hosting provider.
- GitLab / network edge: unexpected restarts, high CPU, service instability, spikes in inbound traffic, or unexplained authentication events.
How attackers may exploit the situation
- Extension marketplace compromise/impersonation: attackers publish lookalike or trojanised extensions where busy teams install quickly, trusting the marketplace brand.
- “Patch-gap” scanning: once a WordPress fix is public, attackers rapidly scan for sites that haven’t updated yet, attempting automated takeover.
- Internet-facing service exploitation: where GitLab or firewall management/interfaces are exposed, attackers may exploit weaknesses to gain access, disrupt services, steal data, or create a path to ransomware.
What to do today
- Check your exposure: confirm whether anyone in your organisation uses Cursor marketplace extensions (or similar) and review recently installed extensions, especially those added in the last 48 hours.
- Lock down website administration: ensure WordPress auto-updates are enabled where appropriate, remove unused plugins/themes, and verify admin accounts and MFA.
- Confirm ownership of “internet-facing” services: if you self-host GitLab (or your MSP does), make sure there is an owner accountable for updates, monitoring, and log review.
- Backups and recovery: verify you have a recent, restorable backup for your website and critical systems (and that you can actually restore it).
Ask your IT provider
- Do we have any developer endpoints using Cursor marketplace extensions, and can we confirm what was installed and when?
- Are our WordPress sites set to auto-update core and security updates, and who monitors for compromise indicators?
- Do we host (or rely on a supplier hosting) GitLab or similar code platforms? Is it internet-facing, and how quickly are security fixes applied?
- Which Cisco firewall models/services do we run, and do we have monitoring/alerts for service disruption?
- If we suspect compromise, what is the containment plan (isolation steps, password resets, log preservation, customer comms)?
Patch watch - only one short paragraph, and only if relevant
Today’s risk is less about “new bugs” and more about attackers moving fast after fixes are released. Prioritise updates for WordPress Core (if you manage sites) and ensure your IT provider confirms remediation plans for any internet-facing GitLab and Cisco firewall exposure flagged as actively exploited.
One action today
Have your IT provider (or internal admin) review and approve all code-editor extensions installed in the last 48 hours, removing anything unverified and rotating any developer credentials if suspicious activity is found.
Related Actions On Cyber resource
Actions On Cyber: Supplier & SaaS Security Quick Checklist (including how to validate marketplaces, manage admin access, and prove backups can restore).
Sources
- Malicious Claude Code extension on Cursor planted SSH backdoors (BleepingComputer)
- WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours (The Hacker News)
- CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV (The Hacker News)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.