Weekly Recap: A Metabase Zero-Day, Poisoned AI Plugins, and Routers Left Wide Open
Old bugs are back, supply chains are getting stranger, and the shortest exploit paths keep being the ones nobody guarded.
Key points
- A critical Metabase flaw is being exploited in the wild, letting attackers run code on unpatched analytics servers.
- Malicious plugins for AI coding assistants are stealing developer credentials through the Model Context Protocol supply chain.
- Router backdoors and default-credential problems are back in the headlines, with consumer and small-business gear the soft entry point again.
- Old bugs, not exotic new ones, drove most of this week's confirmed intrusions.
- Security teams are being told to check exposure now, not next sprint.
Most of this week's incidents didn't start with anything clever. Someone cloned a repository, picked up a phone, or left a server on the internet with its factory settings intact. Same pattern, different week.
Here's what stood out.
What is the Metabase zero-day about?
A zero-day in Metabase, the popular open-source analytics tool, is being used to break into servers before administrators can patch. A zero-day means a flaw the maker didn't know about until attackers were already using it.
Metabase runs inside a lot of companies as the dashboard people use to query their own databases. An attacker who takes it over is effectively sitting next to the data warehouse. Reports this week point to active exploitation against instances exposed to the public internet, a configuration that shouldn't exist but frequently does. We first covered this flaw on 7 August, when customer names, emails and password hashes were taken at Framework and Tally before anyone knew the hole existed.
If you run Metabase, treat this as urgent. Pull the latest release, take the instance off the open internet, and check access logs for anything you can't explain.
How are AI coding tools being turned against developers?
Attackers are publishing booby-trapped plugins for AI assistants that connect through the Model Context Protocol, known as MCP, which is the plumbing that lets AI tools read files, call APIs, execute commands on a developer's machine, and pass results back to the model. Install a bad one and it can quietly copy your API keys and cloud tokens.
The pitch on these plugins looks normal: a helper for a database, a wrapper for a cloud service. Developers install them the same way they install any other package, and there's no strong review layer yet to catch the malicious ones. The Hacker News flagged several examples this week.
This is a supply-chain attack: the criminals compromise a tool you trust so they don't have to attack you directly. Expect more as MCP adoption grows.
Are home and office routers really still the weak link?
Yes. Researchers disclosed fresh backdoors and default-credential problems in consumer and small-business routers this week, and some affected models are still being sold. A backdoor is a hidden way into a device that bypasses the normal login.
For a small business, a compromised router means the attacker sees everything leaving the office: email logins, banking sessions, remote-desktop connections. A household faces a straight line to smart-home devices and personal accounts.
| Story | What broke | Who should act |
|---|---|---|
| Metabase zero-day | Remote code execution on exposed servers | Anyone running Metabase |
| MCP plugin abuse | Malicious AI-assistant plugins stealing dev credentials | Developers using AI coding tools |
| Router backdoors | Hidden accounts and default credentials | Home users and small businesses |
| Old-CVE exploitation | Unpatched flaws from prior years still being used | IT teams behind on patching |
Should you worry about last year's vulnerabilities?
Yes, because they're this week's incidents. The honest message for IT teams is dull: patch the Metabase instance today, audit anything reachable from the public internet, and stop treating prior-year CVEs as prior-year problems.
For most readers, the practical steps are boring and effective. Update router firmware, change any default password still in place, and turn off remote administration unless you genuinely need it.
For developers, slow down before installing an MCP plugin. Check who publishes it, how long it's existed, and whether anyone credible vouches for it. Treat plugin permissions the way you'd treat a browser extension asking to read every page you visit.
What matters most this week isn't any single flaw. It's that the entry points being used are ones defenders already knew about. That's not a technical failure; it's a prioritisation one.
