Free practical cybersecurity guidance for organisations without a security team.
hello@actionsoncyber.com

Daily SMB Cyber Intelligence Brief

Today’s lookout: software supply-chain risk via GitHub/PyPI dependencies

What small and medium-sized businesses should look out for today.

Moderate Sunday 26 July 2026, 18:14 UK time
Today’s look-out: Supplier/SaaS risk – dependency supply-chain attacks (open-source packages)

What to look out for today

Many smaller organisations rely on software built using third-party “packages” (open-source components) pulled from places like GitHub and PyPI (Python Package Index). GitHub and PyPI have announced new time-based protections within Dependabot designed to reduce the impact of supply-chain attacks. Use this as a prompt to check whether your business (or your suppliers) are set up to spot risky dependency changes early.

Why this matters to smaller businesses

  • You may not write software, but your website, client portal, plugins, integrations, analytics, booking systems or internal tools often depend on third-party packages.
  • SMEs are downstream: if a supplier, web agency, MSP, or SaaS vendor ships an update containing a compromised dependency, you can be affected without doing anything “wrong”.
  • Impact is practical: credential theft, data access, website compromise, invoicing fraud setup, or service disruption can follow from a tainted update.

Warning signs

  • Unexpected prompts to update plugins, website components, or line-of-business apps “urgently”.
  • New or unusual outbound connections from servers (e.g. website hosting, integration servers) flagged by your IT provider.
  • Changes to integrations or automations you didn’t request (CRM/email/finance connections).
  • Sudden account lockouts, password reset spikes, or suspicious sign-ins after a routine update.

How attackers may exploit the situation

  • Malicious package updates: attackers try to get unsafe components pulled into real software during normal updates.
  • Typos and lookalikes: packages with similar names can trick developers or automated processes.
  • Rushing the update cycle: creating pressure to deploy quickly, before proper checks, so the bad component lands in production.

What to do today

  • Ask who “owns” dependency risk for your website/apps: internal team, MSP, web agency, or SaaS vendor.
  • Confirm monitoring is actually turned on: if you use GitHub, ask whether Dependabot alerts are enabled and reviewed, and what the response time is.
  • Require change control for updates: even for “minor” updates—what was updated, why, and how it was verified.
  • Make sure backups and rollback exist for any business-critical system so a bad update can be reversed quickly.

Ask your IT provider

  • Do we (or our developers/suppliers) use GitHub and/or Dependabot? If yes, who reviews alerts and how often?
  • For our website and key apps, can you provide a simple list of what’s hosted where, and who can deploy updates?
  • What is our process to test and roll back updates if something looks wrong?
  • How do you monitor for unusual behaviour after updates (logins, network activity, new admin accounts)?

Patch watch - only one short paragraph, and only if relevant

This isn’t about a specific urgent patch today. It’s a reminder that routine updates can introduce risk if supply-chain controls are weak. Focus on governance: monitoring, approval, testing and rollback for updates—especially on externally facing systems like websites and portals.

One action today

Contact your MSP/web agency today and confirm who reviews dependency/security alerts for your website and business apps, and how fast they act on them.

Related Actions On Cyber resource

Actions On Cyber checklist CTA: “Supplier & MSP Security Questions – quick due-diligence list for updates, monitoring and rollback”

Sources

This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.