DebugBear, a website speed monitoring service used by SEO and development teams, told customers on October 29 to remove its real user monitoring (RUM) script from their sites after a security incident. The same day, prediction market Polymarket paused trading. In its October 30 postmortem, Polymarket said a compromised vendor’s performance-monitoring script on its site had been used against logged-in users, and some accounts were drained.

What’s new

  • DebugBear said in a LinkedIn update that attackers changed its DNS records through its domain registrar, so the address its script loads from served attacker code, according to Search Engine Journal’s report on October 31.
  • The company said its early findings show one customer site was targeted, with no sign its internal systems were breached.
  • Hudson Rock’s analysis, cited by SEJ, found the code worked with the permissions a signed-in visitor already had. It didn’t need anyone’s password.
  • It’s still not clear whether other DebugBear customers were served the malicious file, or how long it was live.

Who it affects

Any site that loads the DebugBear RUM snippet, whether it was pasted into the theme, added by a plugin or fired through Google Tag Manager. Most small business sites don’t use DebugBear.

Almost every site loads something similar, though. Analytics tags, chat widgets, heatmaps, review badges and booking embeds all run with the same access to the page as your own code. If a vendor’s domain is taken over, its script can read what’s on the page and act as your visitor. That matters most on pages with logins, checkouts and forms.

Our take

If you use DebugBear RUM, remove the snippet today, purge your page cache and open the browser’s network tab to confirm nothing still loads from debugbear.com. Then reset admin passwords and API keys used on pages where it ran. For everyone else, this is a good week to list every outside script on your site and cut the ones nobody checks anymore. A Content Security Policy won’t stop a hijacked vendor you’ve approved, but it does stop forgotten or unknown tags from running, and fewer scripts also means faster pages.

Our website maintenance work includes script and tag reviews like this, and a technical SEO audit or speed review will flag the tags slowing your pages down.