4 ms·
The author of a library has lost all control over the codebase, and a third party is now making changes to it. That's pretty much the textbook definition of sta
by crote 2y ago
The author of a library has lost all control over the codebase, and a third party is now making changes to it. That's pretty much the textbook definition of stage one of a supply chain attack.
Considering what Matt has already done, it wouldn't even remotely come as a surprise if a future ACF update would, say, brick all WP installations using ACF on a WP Engine host.
- mimsee 2y ago> brick all WP installations using ACF on a WP Engine host That tactic would work, if WP Engine had access to the update server hosted at wordpress.org.
- shprd 2y agoIt's like claiming going to the bank is stage one in a robbery. So if you go to the bank you're a thief. WordPress have the rights, just like the responsibility and possible liability of everything distrubted on their platform.
- chucky123 2y agoIt's more like gaining backdoor access to the bank's server. At this stage no attack has happened(but can happen)
- shprd 2y agoThey didn't gain access anywhere, it's their platform.
- immibis 2y agoIf the bank starts fiddling with the numbers in your account: "I'm not being attacked, it's their database"
- shprd 2y ago> bank starts fiddling with the numbers in your account If a bank messes with your money, you ask for your money when that happens. Not defame the bank based that they updated their database, business as usual, but you liked the old one. how exactly did they mess with your stuff? where's the attack you're speaking about? where's physical harm?