🟠 High | Source: The Hacker News
This weekly security recap covers a cluster of notable threats including a Metabase zero-day vulnerability, supply-chain attacks targeting the Model Context Protocol (MCP), AI systems behaving unexpectedly, and backdoors discovered in consumer routers. The common thread is that attackers are exploiting trust — in defaults, in repositories, in familiar workflows — rather than needing sophisticated entry points. These issues collectively represent a broad attack surface spanning development toolchains, analytics platforms, and network infrastructure.
Security Architect’s Take: Audit your exposure to Metabase instances and apply patches immediately if internet-facing; simultaneously review any MCP-integrated AI tooling for untrusted third-party packages in your supply chain. Ensure router firmware on network perimeters is vendor-supported and default credentials have been removed.
Original advisory: ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors