Drupal Commerce Stores Need Patching, Plus 2 Stories
A store-security update leads today’s brief, but the larger theme is trust. An ecommerce module trusted to enforce permissions, a marketplace trusted to deliver a developer tool, and an employee trusted with patient data all failed at a boundary that was supposed to hold. The useful question isn’t whether technology can be trusted. It’s where the next check belongs when that trust turns out to be misplaced.
Drupal Commerce stores need an update and an audit
The Drupal Security Team says a highly critical access-bypass vulnerability in Commerce Core is being actively exploited. The flaw, tracked as CVE-2026-118539, affects Commerce releases before 8.x-2.41 and the 3.x branch before 3.3.13. Operators should update to the fixed release for the branch they use.
“Access bypass” is broad language, so let’s be precise about what we know. The module did not adequately protect certain routes and entity fields. In plain terms, a request could reach store data or functions without the authorization check the site owner expected. Drupal warns that exploitation could have a financial impact and says attacks are happening now. It has not publicly described the exploit path or the scope of known compromises.
That last part matters. I don’t think this is a patch-and-forget-it update. Patching closes the known door for future requests; it doesn’t tell you whether somebody already walked through it. Store operators should preserve web, application, and audit logs, then review unusual orders, price or adjustment changes, refunds, customer-account changes, newly privileged users, and altered payment or integration settings. Those are sensible audit targets for a commerce access-control failure, not a claim that every one of them is part of this exploit.
If something looks wrong, preserve evidence before restoring a backup or cleaning the site. A clean backup can recover data, but it can also erase the clues needed to understand what happened. This is the same operational lesson behind the recent Magento exploitation: an update handles the vulnerability; logs, independent backups, and access review handle recovery. Shoppers don’t need to take action merely because a store runs Drupal Commerce. The immediate work belongs to the people operating affected sites.
WordPress security & maintenance
Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.
A fake Claude Code extension tried to leave an SSH backdoor
A tampered copy of Anthropic’s Claude Code extension appeared in Cursor’s extension marketplace on October 29. According to Cursor’s security notice, the affected packages were versions 2.1.312 and 2.1.313, installed or updated from Cursor’s marketplace on macOS or Windows between 2:27 a.m. and 1:35 p.m. Pacific time.
This wasn’t an Anthropic breach, and the malicious packages were not served through Microsoft’s Visual Studio Marketplace or npm. It was a marketplace supply-chain attack wearing a familiar publisher name. Microsoft’s analysis found code that tried to add an attacker-controlled SSH key, enable the SSH service, create a reverse SSH tunnel, collect host information, and establish persistence. The reverse tunnel would let the attacker connect back through a machine that might otherwise be protected by a firewall.
Administrative rights and system configuration limited whether every step could succeed, and Cursor says the attacker’s server has been taken offline. Neither fact is a reason to shrug. The installer may still have written an authorized key or persistence files even if the tunnel failed. Anyone in the affected group should follow Cursor’s cleanup instructions, preserve evidence, isolate a machine if indicators are present, and rotate credentials or sessions that may have been exposed. Simply uninstalling the extension doesn’t remove a standalone backdoor it already created.
Technical discovery & auditing
The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.
One spreadsheet turned an AI shortcut into a patient-data exposure
Johns Hopkins Bayview Medical Center is notifying 3,182 patients after a worker uploaded a spreadsheet to a public AI tool the hospital had not approved. WMAR reported that the file could include names, admission or treatment dates, medical record and account numbers, departments, medications, and provider names. The hospital said Social Security numbers and financial details were not included.
That distinction lowers some risks, but it doesn’t make medical information harmless. A treatment date, medication, department, and provider can reveal far more about a person than a stolen email address. The combination can also make a fraudulent call or message sound convincing because the sender knows details a random scammer normally wouldn’t. The hospital is offering 12 months of credit and identity monitoring, though monitoring cannot make private health information private again.
The employee deleted the prompt, thread, and document, and Johns Hopkins asked the unnamed vendor to delete the material. That was necessary, but deleting a chat from the screen doesn’t by itself prove that every server copy, log, backup, or derived record is gone. The tool and its retention terms matter. So do the hospital’s contract with the provider, if there was one. In this case, the tool wasn’t approved, which is exactly the problem.
For other organizations, the lesson is more useful than “tell employees not to do that.” Give people an approved tool for legitimate work, define what data may enter it, turn off training or long retention where the service allows it, and use technical controls to detect sensitive uploads. A policy without a workable alternative is a sign on an unlocked door. Affected Hopkins patients should read the mailed notice and use the offered monitoring if it makes sense for them. Everyone else can skip the panic and ask a practical question at work: where does confidential information go when somebody pastes it into an AI prompt?
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources and further reading
- Drupal Security Team: Commerce Core access-bypass advisory
- Canadian Centre for Cyber Security: Drupal advisory AV26-1105
- Cursor: malicious Claude Code extension notice
- Microsoft Security: technical analysis of the SSH backdoor
- WMAR: Johns Hopkins Bayview patient notification
- WYPR: details of the September 21 AI upload
Photo by Kampus Production on Pexels.
