『Rank Math PRO Backdoored, Plex Servers Hijacked, ClickFix Goes Signed』のカバーアート

Rank Math PRO Backdoored, Plex Servers Hijacked, ClickFix Goes Signed

Rank Math PRO Backdoored, Plex Servers Hijacked, ClickFix Goes Signed

無料で聴く

ポッドキャストの詳細を見る
Rank Math PRO Backdoored, Plex Servers Hijacked, ClickFix Goes Signed Tuesday, October 20, 2026: Rank Math PRO's own update channel shipped a self-restoring WordPress backdoor, the Plex2Shell chain is being exploited for miners and proxy backdoors, ClickFix crews are sideloading malware through a signed Siemens app, GhostAction is phishing developers and hiding a stealer in a font file, and investigators suspect a ransom negotiator helped run ShinyHunters' extortion site. 1. A WordPress SEO plugin shipped its own backdoor Copies of Rank Math PRO downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware that recreates a hidden backdoor on every site visit. The clean 3.0.124 replaces the plugin but does not remove PHP backdoors in other plugin, theme, and mu-plugins folders, wpsupport_ admin accounts, crontab entries, or SSH keys the malware may have planted. The version number (3.0.123) does not show whether a copy is affected. The free WordPress.org plugin is not named in the notice. CVE: CVE-2026-111862 (CVSS 9.8, Wordfence). Do this today: if a site installed and activated Rank Math PRO during the window, restore from a pre-October 15 backup, or delete the entire rank-math-pro folder, remove the listed wp_options entries, and block rank1cdn[.]com before cleanup; then rotate every password, database credential, salt, and API key the site could reach, and install 3.0.124 from your Rank Math account. Source: The Hacker News: Rank Math PRO hijacked to deliver self-restoring backdoor 2. Plex servers are getting popped for crypto mining Attackers began chaining four Plex Media Server flaws, dubbed Plex2Shell, for unauthenticated remote code execution a day after technical details went public on October 16. Payloads include an XMRig miner ("mylovelyminer") and "myawesomeproxy," a stealthy Linux backdoor and reverse proxy, with infrastructure linked to the AISURU DDoS and proxyware botnet. The bugs were reported by Zach Main in July and fixed in Plex Media Server 1.43.3.10861 on August 3. CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 (plus related CVE-2026-96651). Do this today: update Plex Media Server to 1.43.3.10861 or newer, remove it from direct internet exposure if you don't need remote access, and check for unknown miner processes and connections to 217.60.194[.]116 or proxystream[.]st. Source: The Hacker News: Hackers exploit Plex2Shell flaws 3. ClickFix crooks are hiding behind a signed Siemens app Siemens patched a DLL sideloading flaw in Siemens Software Center after attackers placed a malicious archive.dll next to a genuine, signed copy of the app (version 3.5.8.7) to run their code. Huntress found campaigns using malicious ChatGPT Custom GPTs to steer victims to ClickFix lures whose PowerShell drops an MSI that launches the Siemens app and loads a remote access trojan. The activity is tied to the Romulus ClickFix platform. CVE: CVE-2026-110936 (CVSS v4 8.4), fixed in version 4.0.9.8. Do this today: update Siemens Software Center to 4.0.9.8 or later and launch it once to apply the update, block 96.62.218[.]59, wizardexpensive[.]com, and 2.27.248[.]127, and hunt for SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec.exe. Sources: The Hacker News: ClickFix attackers exploit Siemens Software Center flaw, The Hacker News: ROMULUS ClickFix platform 4. GhostAction is phishing developers and hiding malware in a font The GhostAction operators registered my-github[.]com and phished a maintainer with a fake GitHub security alert; the reverse-proxy page harvests the password and 2FA code, then silently authorizes an OAuth device flow with repo, workflow, and read:org scopes. A second stage in 94 repositories adds a VS Code tasks.json that runs on folder open and a fake font file (public/fonts/fa-solid-400.woff2) that steals cloud, npm, PyPI, Kubernetes, SSH, and Claude and Gemini credentials and installs a five-minute cron job. CVE: none (supply chain and phishing campaign). Do this today: disable automatic tasks in VS Code (task.allowAutomaticTasks), review authorized OAuth apps in GitHub settings from a clean device, block my-github[.]com and 193.32.204[.]199, and rotate any credentials a compromised workflow could reach. Source: The Hacker News: GhostAction plants credential stealer disguised as font in 94 GitHub repositories 5. The feds think a ransom negotiator helped run an extortion site KrebsOnSecurity reports that investigators pursuing ShinyHunters identified executives at two ransomware negotiation firms with unusually close ties to the group, and believe at least one executive at a U.S. consulting firm helped operate the shinywire[.]com extortion site, which listed nearly 100 victims until October 16. That executive has not been charged; Canadian negotiator Edward Dubrovsky was arrested earlier this month. The FBI says ShinyHunters has extorted more than $70 million ...
adbl_web_anon_alc_button_suppression_t1
まだレビューはありません