GitLab and Drupal Under Active Attack, Plus Supply Chain Breach in Cursor

CISA has confirmed active exploitation of a maximum-severity GitLab vulnerability allowing unauthenticated remote code execution, while Drupal Commerce Core faces a critical access bypass attack in the wild. Both flaws pose immediate risk to UK businesses and the agencies managing their infrastructure. Meanwhile, a supply chain compromise in the Cursor Marketplace on 29 October introduced a persistent SSH backdoor into developer environments, creating lateral risk for every client those developers serve. Today’s briefing examines the common thread connecting these incidents: downstream exposure through trusted third parties. Mauven walks through immediate verification steps for GitLab and Drupal users, explains how to check for the Cursor SSH key compromise, and frames the structural supply chain risk that UK SMBs consistently underestimate. Patches exist for the first two vulnerabilities. The question is whether your suppliers have applied them.

Chapters

• Introduction Overview of today’s three incidents: actively exploited vulnerabilities in GitLab and Drupal Commerce Core, and a supply chain compromise in the Cursor Marketplace that hasn’t received sufficient attention.
• GitLab Remote Code Execution: CISA Confirms Active Exploitation CISA adds a maximum-severity GitLab vulnerability to its Known Exploited Vulnerabilities catalogue. The flaw permits unauthenticated remote code execution and is being exploited in the wild. GitLab’s widespread deployment among UK agencies and MSPs means exposure extends to every client relying on those providers. Immediate patch verification required.
• Call to Action Reminder to follow the show and share with colleagues who need threat intelligence.
• Drupal Commerce Core: Access Bypass Under Active Attack Drupal warns of active exploitation targeting a critical access bypass vulnerability in Commerce Core, affecting e-commerce functionality including customer data and order systems. The module’s prevalence across UK retail and public sector sites makes this a live incident risk until patches are confirmed applied.
• Supply Chain in Developer Tooling: The Cursor Marketplace Compromise Version 2.1.313 of the Claude Code extension in Cursor Marketplace was compromised on 29 October with a malicious loader that plants an attacker-controlled SSH key labelled ‘svc-telemetry’ and establishes persistent remote access. Developer machine compromise creates lateral risk to every client system those developers can reach.
• The Pattern Connecting Today’s Stories All three incidents share a common structure: downstream organisations are the primary victims through trusted supplier relationships. Supply chain risk in UK SMBs remains underestimated because patch compliance and security posture cannot be audited from outside without contractual requirements and active verification.
• Closing Actions and Sign-Off Three immediate actions: confirm GitLab and Drupal patch status in writing today, check authorised keys files for the Cursor compromise, and ask IT providers directly about their patch turnaround for actively exploited vulnerabilities. Patches exist; the question is whether suppliers have applied them.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.ncsc.gov.uk/guidance/vulnerability-management
• https://www.drupal.org/security
• https://www.huntress.com/
• https://www.binance.com/
• https://www.ncsc.gov.uk/news/star-blizzard-campaign-targeting-uk-individuals-and-organisations