Attacker Bought 30 WordPress Plugins on Flippa and Backdoored All of Them

来源: InfoQ | 原文链接
采集时间: 2026-05-09 09:42:34

资讯概要

An attacker purchased 30+ WordPress plugins on Flippa for six figures, planted a PHP deserialization backdoor in the first commit, and waited eight months before activating it across 400,000 installations. The attack used Ethereum smart contracts to resolve C2. WordPress.org has no mechanism for reviewing plugin ownership transfers, a gap that npm and PyPI addres

⚠️ 注意：本文为RSS摘要采集，完整内容请访问 原文链接 查看。