WordPress RCE, APT29 Zero-Click Mobile Attacks, and AI Supply Chain Crisis

The fourth of November briefing opens with an urgent WordPress remote code execution vulnerability now under active exploitation, affecting a significant portion of UK SMB websites. CISA’s KEV listing confirms mass scanning is already underway, making immediate patch verification essential. The second thread examines APT29’s large-scale watering hole campaign exploiting unpatched mobile devices through zero-click attacks, compromising iOS and Android systems invisibly. The main focus is Black October: nine AI developer platforms breached throughout October 2026, with stolen credentials fuelling LLMJacking attacks generating hundred-thousand-pound fraudulent charges. The Cursor marketplace incident saw malicious Claude Code extensions install persistent SSH backdoors surviving removal and reboots. Yoba campaigns use digitally signed legitimate executables to sideload cryptocurrency miners, evading signature-based detection. The briefing closes with the cPGuard supply chain compromise, where attackers weaponised trusted update infrastructure to distribute backdoors. Across all threads, the pattern is clear: exploitation succeeds not through sophisticated attacks, but through gaps between assumed security measures and actual implementation.

Chapters

• Introduction Daily briefing overview: WordPress RCE under active exploitation, APT29 zero-click mobile attacks, and October’s systematic AI developer tool compromises.
• WordPress RCE: Patched Does Not Mean Protected CISA KEV listing confirms active WordPress exploitation. Mass scanning underway before official announcements. UK SMBs must verify patches directly with hosting providers rather than assuming updates are applied.
• Call to Action Follow the show for automatic briefings and share with UK business owners whose WordPress sites may be at risk.
• APT29 Mobile Watering Holes: Zero-Click Means Zero Warning Russian state actor APT29 runs large-scale watering hole campaign exploiting n-day mobile vulnerabilities on both iOS and Android. Zero-click exploitation requires no user interaction. Deferred mobile updates create exploitable gaps.
• Black October: AI Tool Supply Chain Crisis Nine AI developer platforms breached throughout October 2026. Stolen credentials enable LLMJacking attacks with six-figure fraudulent charges. Cursor marketplace distributed malicious Claude Code extension with persistent SSH backdoors. Yoba campaign uses digitally signed executables for DLL sideloading. Systematic targeting of AI tools creates downstream exposure for all organisations using compromised developers.
• cPGuard Supply Chain Compromise Attackers compromised cPGuard update infrastructure, distributing backdoors through legitimate autoupdate mechanism. Trusted security tool became delivery vehicle for malware.
• Closing Common pattern across all threats: exploitation succeeds through gaps between assumed and actual security implementation. Confirm rather than assume, ask rather than wait.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.wiz.io/blog/black-october-ai-developer-platforms-breached
• https://cloud.google.com/blog/topics/threat-intelligence/llmjacking
• https://www.microsoft.com/en-us/security/blog/2026/10/30/cursor-marketplace-malicious-extension
• https://expel.com/blog/cursor-claude-code-backdoor-analysis/
• https://www.bleepingcomputer.com/news/security/cpguard-supply-chain-attack/
• https://www.ncsc.gov.uk/collection/supply-chain-security