Developer tools security is under active assault this week. CISA has confirmed exploitation of a maximum severity GitLab vulnerability (CVE-2026-97229) allowing unauthenticated remote code execution, and Drupal Commerce sites are being attacked to bypass payment authorization, while malicious developer extensions and poisoned supply chains now pose direct downtime and data loss risks to any small business relying on these platforms.
In today's cybersecurity update for October 30th, 2026, small business owners face several critical security threats requiring immediate action:
GITLAB MAXIMUM SEVERITY FLAW NOW EXPLOITED: CISA has confirmed active exploitation of a maximum severity GitLab vulnerability (CVE-2026-97229) that allows unauthenticated remote code execution on both Community and Enterprise Edition servers. The flaw was patched on October 9th, but any GitLab instances not updated since then remain vulnerable. Federal agencies must patch by November 17th. Businesses using GitLab for development should update immediately.
DRUPAL COMMERCE STORES UNDER ACTIVE ATTACK: Hackers are actively exploiting a highly critical access control vulnerability (CVE-2026-118539) in Drupal Commerce Core that allows attackers to bypass payment authorization and purchase products for one cent. Any e-commerce site running on Drupal Commerce needs to update immediately to prevent financial losses. The flaw affects the module used to sell products and services on Drupal websites.
POISONED DEVELOPER EXTENSION PLANTS SSH BACKDOORS: A malicious version of Anthropic's Claude Code extension was distributed through the Cursor marketplace for approximately 11 hours on October 29th, potentially exposing up to 5,000 developers to malware that installs persistent SSH backdoors. The compromised extension has been removed and replaced with a clean version. Development teams using Cursor should verify their installations and rotate credentials if the extension was installed on October 29th.
TREZOR HARDWARE WALLET SPY IMPLANT WARNING: Trezor is warning customers about a suspected hardware implant in Safe 5 wallets sold by reseller CryptoBilis since March 2026. The suspected implant contains an extra circuit board that transmits recovery phrases over a mobile network. Anyone who purchased a Trezor from CryptoBilis should immediately move funds to a new wallet with a new recovery phrase. This incident emphasizes the importance of purchasing hardware security devices only from manufacturers or verified authorized resellers.
WORDPRESS RACE CONDITION UNDER ATTACK: Attackers are attempting to exploit a high-severity unauthenticated race condition in WordPress that leads to remote code execution. WordPress site owners should ensure their installations are updated to the latest version to prevent attackers from running unauthorized code on their websites.
KAIROS BOTNET EXPLOITS PASSWORDLESS TELNET: A new DDoS botnet called Kairos is spreading by scanning for Linux devices with Telnet services that accept root login with no password. Once compromised, devices are infected with Go-based malware that enrolls them in distributed denial-of-service operations. Businesses with Linux servers, routers, or network devices should disable Telnet or ensure it requires strong authentication.
Why developer tools security matters for your SMB right now
Three separate attack vectors target the tools your development team uses daily. CVE-2026-97229 in GitLab Community and Enterprise Edition permits remote code execution without authentication; any instance not patched since October 9th is vulnerable to attackers running arbitrary commands on your servers. CVE-2026-118539 in Drupal Commerce bypasses payment controls, allowing fraudsters to purchase inventory for one cent. A poisoned Claude Code extension distributed through the Cursor marketplace on October 29th was designed to install persistent SSH backdoors. CISA recommends federal agencies patch GitLab by November 17th. Action: Patch GitLab and Drupal immediately. Audit your Cursor extension version history; if installed on October 29th, rotate all SSH and service credentials. Review development server access logs for unauthorized activity.
Key takeaways
- GitLab CVE-2026-97229 allows unauthenticated remote code execution. Patch all instances immediately; federal agencies have a November 17th deadline.
- Drupal Commerce CVE-2026-118539 is being exploited now to bypass payment checks. Update core modules to prevent fraud on e-commerce sites.
- A poisoned Claude Code extension in Cursor was distributed on October 29th. Verify your installation date and rotate SSH credentials if affected.
- Trezor hardware wallets sold by CryptoBilis may contain spy implants. Move crypto to a new wallet from an authorized reseller immediately.
Frequently asked questions
Do we need to patch GitLab if we are not a software development company?
If your team uses GitLab for any project tracking, documentation, or code collaboration, you must patch. CVE-2026-97229 requires no authentication, so an attacker can execute code on your server without a login. Unpatched instances are vulnerable regardless of company type.
What should we do if we used Cursor on October 29th?
Check the Claude Code extension version history in Cursor. If it was installed on October 29th, rotate all SSH keys, service account passwords, and API tokens immediately. Review server access logs for unauthorized logins during and after that date.
We bought a Trezor wallet but do not remember the reseller. What do we do?
If purchased from CryptoBilis since March 2026, move funds to a new wallet and new recovery phrase immediately. For any wallet purchased elsewhere, verify you bought from Trezor.io directly or an official reseller. Inspect the device for physical signs of tampering or extra circuit boards.
Can our WordPress site be attacked without us knowing?
Yes. The WordPress race condition allows unauthenticated remote code execution. An attacker can run malicious code and plant backdoors without triggering typical alerts. Update WordPress immediately and review recent access logs for suspicious requests.
Sources
- https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/
- https://www.bleepingcomputer.com/news/security/hackers-now-exploiting-max-severity-gitlab-flaw-in-attacks/
- https://gbhackers.com/cisa-gitlab-vulnerability-cve-2026-97229/
- https://cybersecuritynews.com/critical-drupal-commerce-vulnerability/
- https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html
- https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/
- https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html
- https://thehackernews.com/2026/10/trezor-warns-of-suspected-hardware.html
- https://gbhackers.com/trezor-warns-of-suspected-spy-implant/
- https://cybersecuritynews.com/hackers-exploit-passwordless-telnet/
Keep reading
Produced with AI from TC3's daily cyber briefing video. Not individually reviewed before publishing; questions go to a human at [email protected].