Google Details Turla’s New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks
Google Threat Intelligence Group (GTIG) has attributed a previously undocumented .NET backdoor named STOCKSTAY to the Russian state-sponsored threat actor Turla. The…
Tag: WordPress
Supply Chain Attack Hits Three WordPress Plugins: PushEngage, OptinMonster, TrustPulse Backdoored
An attacker tampered with trusted JavaScript files used by WordPress sites running PushEngage, OptinMonster, and TrustPulse, turning those files into a way…
UpdraftPlus Authentication Bypass Vulnerability (CVE-2026-10795)
A high-severity authentication bypass vulnerability in the UpdraftPlus WordPress backup plugin, rated 8.1 by Wordfence. It is now patched and has been…
Web Shell Backdoor Used in WordPress Plugin Supply Chain Attack
A hidden plugin installed by the attacker acts as a web shell, allowing remote command execution on the compromised server without authentication.
Awesome Motive: Company Behind Compromised WordPress Plugins
Awesome Motive is the parent company of PushEngage, OptinMonster, and TrustPulse. The company had not commented on the two larger plugins as…
ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures
Cybersecurity researchers have identified multiple ClickFix campaigns deploying three new malware loaders: BabaDeda Loader, Lorem Ipsum Loader, and Potemkin. These campaigns use…
Lorem Ipsum Loader: A New Backdoor Delivered via Compromised WordPress Sites
Lorem Ipsum Loader is a nascent loader and backdoor active since February 2026. It is delivered through ClickFix lures on compromised WordPress…
Beloved PBN Entegrasyonu: Fake WordPress Plugin for Backlink Injection
Beloved PBN Entegrasyonu is a fake WordPress plugin used by a Turkish-speaking threat actor to inject hidden backlinks for a Private Blog…
CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity vulnerability affecting the Widget Factory Joomla Content Editor (JCE) to…
Turkish-Speaking Threat Actor Behind WordPress PBN Backlink Campaign
A Turkish-speaking threat actor is operating a campaign that compromises WordPress sites to inject hidden backlinks for a Private Blog Network (PBN),…