4 ms·

Over 6k WordPress hacked to install plugins pushing infostealers

pluc 2y ago
Guess all the "Automattic security team" is busy looking for vulnerabilities in competing products.
bigiain 2y ago
It is, of course, a malware writer's first amendment right to publish those plugins... https://ma.tt/2024/10/first-amendment/ https://ma.tt/2024/10/first-amendment/
sksxihve 2y ago
What share of the revenue do the hackers owe Automattic?
stefanos82 2y ago
After years of using and developing custom solutions with WordPress, as soon as I saw the checkbox fiasco, I said enough is enough and to call it quits with WP as a whole and deleted all my projects; I prefer to invest my time and energy elsewhere, it's not worth it anymore.
- djvuvtgcuehb 2y ago
  [dead]
- browningstreet 2y ago
  I have a few major wordpress projects that rely on a commercial Wordpress plugin. There’s no place for me to go, at this moment in time. But I’m also personally getting tired of all this. I was prepared to dump Apple when they had their CSAM initiative. I bought a Tesla and then Elon goes super mad. I run Wordpress sites for my income and Matt goes super mad. I run Linux as much as I can but a lot of my media output is dependent on binary supported video output. OSS is the foundation of our cloud layers but not amazing for desktop loads. Commercial companies are quite shady nowadays, and people like me who built their incomes on it have to consider how principled they are want to be. If I want to stay commercial and prioritize my income, I can’t even really entertain the principle dimension in my tool chain.
  - timschmidt 2y ago
    > OSS is the foundation of our cloud layers but not amazing for desktop loads. That's news to those of us who have been using it for... check's watch... 25 years on the desktop.
    - browningstreet 2y ago
      Thanks for ignoring the previous sentence. It provided context for my following assertion.
      - timschmidt 2y ago
        Maybe I just don't understand what a "binary supported video output" is intended to convey? Perhaps you could clarify how or why this task isn't possible with Linux? Avoiding maligning the desktop worthiness of all of OSS because your niche app isn't available could have saved the exchange.
  - pessimizer 2y ago
    Wordpress isn't OSS, it's Free Software.
    - bigiain 2y ago
      Isn't GPL about as "OSS" as you can get? What distinction are you drawing between "OSS" and "Free Software" here?
      - left-struck 2y ago
        Something can be open source but not free as in freedom, as in you can see the source but copyright is reserved, maybe that’s what they mean? But WP is also open source and they specifically said it’s not so idk
        Flimm 2y ago
claudiulodro 2y ago
Great snark from people that apparently didn't read the article, but this article is about hackers using stolen admin credentials to install a malicious plugin that renders popups with malware to site visitors.

pluc 2y ago

Guess all the "Automattic security team" is busy looking for vulnerabilities in competing products.

It is, of course, a malware writer's first amendment right to publish those plugins... https://ma.tt/2024/10/first-amendment/ https://ma.tt/2024/10/first-amendment/

sksxihve 2y ago

What share of the revenue do the hackers owe Automattic?

stefanos82 2y ago

After years of using and developing custom solutions with WordPress, as soon as I saw the checkbox fiasco, I said enough is enough and to call it quits with WP as a whole and deleted all my projects; I prefer to invest my time and energy elsewhere, it's not worth it anymore.

djvuvtgcuehb 2y ago
[dead]
browningstreet 2y ago
I have a few major wordpress projects that rely on a commercial Wordpress plugin. There’s no place for me to go, at this moment in time. But I’m also personally getting tired of all this. I was prepared to dump Apple when they had their CSAM initiative. I bought a Tesla and then Elon goes super mad. I run Wordpress sites for my income and Matt goes super mad. I run Linux as much as I can but a lot of my media output is dependent on binary supported video output. OSS is the foundation of our cloud layers but not amazing for desktop loads. Commercial companies are quite shady nowadays, and people like me who built their incomes on it have to consider how principled they are want to be. If I want to stay commercial and prioritize my income, I can’t even really entertain the principle dimension in my tool chain.
- timschmidt 2y ago
  > OSS is the foundation of our cloud layers but not amazing for desktop loads. That's news to those of us who have been using it for... check's watch... 25 years on the desktop.
  - browningstreet 2y ago
    Thanks for ignoring the previous sentence. It provided context for my following assertion.
    - timschmidt 2y ago
      Maybe I just don't understand what a "binary supported video output" is intended to convey? Perhaps you could clarify how or why this task isn't possible with Linux? Avoiding maligning the desktop worthiness of all of OSS because your niche app isn't available could have saved the exchange.
- pessimizer 2y ago
  Wordpress isn't OSS, it's Free Software.
  - bigiain 2y ago
    Isn't GPL about as "OSS" as you can get? What distinction are you drawing between "OSS" and "Free Software" here?
    - left-struck 2y ago
      Something can be open source but not free as in freedom, as in you can see the source but copyright is reserved, maybe that’s what they mean? But WP is also open source and they specifically said it’s not so idk
      - Flimm 2y ago

claudiulodro 2y ago

Great snark from people that apparently didn't read the article, but this article is about hackers using stolen admin credentials to install a malicious plugin that renders popups with malware to site visitors.