Weekly Recap: A Metabase Zero-Day, Poisoned AI Plugins, and Routers Left Wide Open

Key points

• A critical Metabase flaw is being exploited in the wild, letting attackers run code on unpatched analytics servers.
• Malicious plugins for AI coding assistants are stealing developer credentials through the Model Context Protocol supply chain.
• Router backdoors and default settings are back in the headlines, with home and small-business gear once again the soft entry point.
• Old bugs, not exotic new ones, drove most of this week's confirmed intrusions.
• Security teams are being told to check exposure now, not next sprint.

Most of the incidents worth discussing this week did not start with anything clever. They started with someone cloning a repository, picking up a phone, or leaving a server on the internet with its factory settings intact. That is the pattern, and it is not a new one.

Here is what stood out.

What is the Metabase zero-day about?

A zero-day in Metabase, the popular open-source analytics tool, is being used to break into servers before administrators can patch. A zero-day means a software flaw the maker did not know about until attackers were already using it.

Metabase runs inside a lot of companies as the dashboard people use to query their own databases. If an attacker takes it over, they are effectively sitting next to the data warehouse. Reports this week point to active exploitation against instances exposed to the public internet, which is a configuration that should not exist but frequently does.

If you run Metabase, treat this as urgent. Pull the latest release from the vendor, take the instance off the open internet, and check access logs for anything you cannot explain.

How are AI coding tools being turned against developers?

Attackers are publishing booby-trapped plugins for AI assistants that plug into the Model Context Protocol, known as MCP, which is the plumbing that lets AI tools read files, call APIs and run commands on a developer's machine. Install a bad one and it can quietly copy your API keys, cloud tokens and source code.

The pitch on these plugins looks normal. A helper for a database. A wrapper for a cloud service. Developers install them the same way they install any other package, and there is not yet a strong review layer to catch the malicious ones. The Hacker News flagged several examples this week.

This is a classic supply-chain attack, meaning the criminals compromise a tool you trust so they do not have to attack you directly. Expect more of it as MCP adoption grows.

Are home and office routers really still the weak link?

Yes. Researchers disclosed fresh backdoors and default-credential problems in consumer and small-business routers this week, and some of the affected models are still being sold. A backdoor is a hidden way into a device that bypasses the normal login.

For a small business, a compromised router means the attacker sees everything leaving the office: email logins, banking sessions, remote-desktop connections. For a household, it is a straight line to smart-home devices and personal accounts.

What should ordinary users and IT teams do now?

For most readers, the practical steps are boring and effective. Update the router firmware, change any default password still in place, and turn off remote administration unless you truly need it.

For developers, slow down before installing an MCP plugin. Check who publishes it, how long it has existed, and whether anyone credible vouches for it. Treat plugin permissions the way you would treat a browser extension asking to read every page you visit.

For IT teams, the message is duller still: patch the Metabase box today, audit anything reachable from the public internet, and stop assuming last year's vulnerabilities are last year's problem. They are this week's incidents.