Threat Analysis: GitLab RCE and Drupal Commerce Under Active Exploit, Plus the Supply Chain Risks Your Dev Team Is Missing
This is your Daily Threat Analysis for the 30th of October 2026.
Two actively exploited vulnerabilities confirmed today. Both sit in platforms that UK small and medium businesses, and more often their agencies and managed service providers, run on their behalf. The patches exist. The question, as ever, is whether anyone has applied them.
We will also look at a supply chain compromise in a developer tool that landed yesterday evening and has not received the attention it deserves, and close with a brief note on a pattern that connects several of today’s stories.
GitLab Remote Code Execution: CISA Confirms Active Exploitation
CISA has added a maximum-severity GitLab vulnerability to its Known Exploited Vulnerabilities catalogue. The flaw allows unauthenticated remote code execution, meaning an attacker does not need a valid account to compromise a vulnerable instance. GitLab issued a patch earlier this month. Attackers are now exploiting it in the wild.
The advisory designation from CISA is not academic. When something lands on the KEV catalogue, it means observed exploitation is confirmed, not theoretical. Federal agencies in the United States are required to patch within a defined window. UK organisations have no equivalent legal obligation, but the signal is the same: this is being used right now.
What the advisory does not tell you is who is running vulnerable instances. GitLab is widely deployed by software development teams across the UK, including at digital agencies and managed service providers who host GitLab on behalf of multiple clients. If your agency or MSP is running a self-hosted GitLab instance and has not applied the patch issued earlier this month, you are not looking at one exposed organisation. You are looking at every project, every repository, every client credential stored in that instance.
The NCSC has published guidance on patch management cycles and third-party software risk. The fact that maximum-severity, actively exploited vulnerabilities in common development platforms still require external advisories to prompt action tells you what you need to know about how seriously that guidance is being applied.
What to do: If you run GitLab internally, apply the patch issued earlier this month immediately. If a third party manages GitLab on your behalf, contact them today and ask for written confirmation that the patch has been applied. Do not accept a verbal assurance. Get the version number. If they cannot confirm it, escalate.
Drupal Commerce Core: Access Bypass Under Active Attack
Drupal has issued a warning that a critical access bypass vulnerability in its Commerce Core module is being actively exploited in the wild. An access bypass flaw of this severity means that an attacker can reach functionality or data that should require authentication, without providing valid credentials.
Drupal is not a niche platform. It powers a substantial proportion of mid-market retail, professional services, and public sector websites in the UK. Commerce Core is the module that handles e-commerce functionality: orders, customer accounts, product catalogues, and in many implementations, integration with payment processors.
An access bypass in this context is not a theoretical data exposure. Depending on site configuration, it could allow an attacker to access order histories, customer personal data, or administrative functions without logging in. For any business running Drupal Commerce, this should be treated as a live incident risk until the patch is confirmed applied.
The broader pattern is worth noting. Drupal vulnerabilities in Commerce and similar modules have historically been exploited quickly after public disclosure, because the attack surface is well understood and the tooling for automated scanning is widely available. By the time Drupal issues an advisory confirming active exploitation, opportunistic scanning is almost certainly already underway at scale.
What to do: If you run a Drupal-based site with Commerce Core, apply the patch Drupal has released immediately. If a web agency manages your site, contact them today. Ask which version of Commerce Core is installed, confirm the patch status, and ask for a written response. If your site handles customer payment data or personal information under UK GDPR, a known exploited vulnerability in your e-commerce platform is a matter your Data Protection Officer or legal team should also be aware of.
Supply Chain in Developer Tooling: The Cursor Marketplace Compromise
This one landed on the 29th of October and deserves more attention than it has received so far.
Version 2.1.313 of the Claude Code extension in the Cursor Marketplace was compromised. A malicious 66-line loader was inserted into the extension’s main JavaScript file before the legitimate extension code. When activated, it adds an attacker-controlled SSH key, labelled ‘svc-telemetry’ to avoid casual scrutiny, to the victim’s authorised keys file, attempts to enable local SSH services, and establishes a reverse SSH tunnel to attacker-controlled infrastructure.
Let that sit for a moment. A developer installs what appears to be a legitimate, listed extension in a popular AI coding tool. The extension functions normally. In the background, the attacker now has persistent SSH access to that developer’s machine.
The label ‘svc-telemetry’ is a deliberate choice. It is designed to look like a legitimate service account key to anyone who happens to glance at their authorised keys file, which, in practice, most people never do.
This matters to UK SMBs for a reason that goes beyond the developer community. Developers at agencies and MSPs work on client infrastructure. A compromised developer machine is not one compromised workstation: it is a potential pivot point into every system that developer has access to. The same pattern appeared in the Binance incident reported today, where a $6.3 billion cryptocurrency theft was traced back to a compromised DevOps engineer’s laptop. The blast radius of a single compromised privileged workstation is not bounded by that workstation.
If your organisation uses Cursor, or if your development agency does, the immediate action is to check authorised keys files on developer machines for any unfamiliar entries, particularly anything labelled ‘svc-telemetry’. Rotate any credentials stored on or accessible from affected machines. Confirm with your agency or MSP whether they use Cursor in their development environment.
The Pattern Connecting Today’s Stories
Three separate incidents. Three different attack surfaces. One common thread.
In each case, the GitLab exploitation, the Drupal Commerce attacks, the Cursor Marketplace compromise, the primary victim is not the organisation named in the headline. The primary victims are the organisations downstream: the clients of the MSP running the unpatched GitLab instance, the customers whose data sits in the Drupal Commerce database, the clients of the agency whose developer’s machine now has an unauthorised SSH key.
This is the supply chain risk that UK SMBs consistently underestimate. You cannot audit a vendor’s patch compliance from the outside. You can ask for it. You can require it in contracts. You can escalate when you do not get a clear answer. Most businesses do none of these things, and most IT providers rely on that.
Huntress published research today on a related pattern: attackers weaponising legitimate mobile device management platforms through social engineering to establish remote access to victim systems. The method is different. The principle is identical. Legitimate tools, trusted relationships, and the assumption that someone else is checking, these are the conditions that make supply chain attacks so consistently effective.
Star Blizzard, the Russian FSB-linked group, has been operating against UK targets, government officials, think tanks, NGOs, and the professional services firms that support them, using exactly this model: exploiting trusted relationships and legitimate platform features rather than zero-days. Their credential theft and hack-and-leak campaigns have been documented since at least 2019. The TTPs have evolved. The underlying principle has not changed.
Before You Go
If Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and pass it to someone who needs the heads-up. The people who most need this information are often the ones not looking for it.
Three actions for today:
- If you or your agency run GitLab or Drupal Commerce, confirm patch status in writing before end of day.
- If your development environment uses Cursor or the Claude Code extension via any marketplace, check authorised keys files on affected machines now.
- Ask your IT provider or MSP what their patch SLA is for actively exploited vulnerabilities. If they cannot answer that question clearly, that is your answer.