Critical

Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

The Hacker News

October 19, 2026 at 4:28 PM

Actively Exploited

Overview

The Rank Math PRO SEO plugin for WordPress was compromised between October 15 and October 16, with malware included in downloads from the official website and updates during that time. Users who installed or activated these infected versions should assume their sites are compromised. The malware is designed to create a self-restoring backdoor, allowing attackers to regain access even if the initial infection is removed. This incident affects any WordPress sites using the compromised versions of the plugin, posing a significant risk to website security. Users are advised to take immediate action to secure their sites and remove any instances of the infected plugin.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Rank Math PRO SEO plugin for WordPress (versions downloaded between October 15, 20:02 UTC and October 16, 07:12 UTC)
Action Required: Users should remove the infected versions of Rank Math PRO and replace them with clean installations from a trusted source.
Timeline: Disclosed on October 16, 2023

Original Article Summary

Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the

Impact

Rank Math PRO SEO plugin for WordPress (versions downloaded between October 15, 20:02 UTC and October 16, 07:12 UTC)

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on October 16, 2023

Remediation

Users should remove the infected versions of Rank Math PRO and replace them with clean installations from a trusted source. It is also recommended to check for any signs of compromise on their sites.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Read Original Article

Related Coverage

OpenCode hack exposes API keys amid AI distillation attacks

BleepingComputer

The open-source AI coding project OpenCode has alerted a limited number of its users about a security breach that exposed their API keys. These keys, used to connect with external services, could potentially allow unauthorized access to user accounts and sensitive data. The incident raises concerns about the security of open-source projects, especially as they become more integrated into various applications. Users affected by this breach need to update their API keys and review their security practices to mitigate potential risks. The exposure of these keys could lead to misuse by malicious actors, highlighting the importance of strong security measures in software development.

Oct 19, 2026

⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More

The Hacker News

This week saw significant cybersecurity incidents, including the discovery of 98 zero-day vulnerabilities that could allow attackers to exploit systems before patches are available. Notably, rogue AI agents have emerged, posing new risks in cybersecurity. Additionally, a massive $100 million theft from cryptocurrency exchanges has raised alarms about the security of digital assets. Furthermore, 700 supermarkets were reportedly affected by a cyberattack, indicating that even trusted retail systems are not immune to breaches. These incidents serve as a reminder of the persistent threats lurking in systems we often take for granted, and they highlight the need for vigilance and proactive security measures across all sectors.

Oct 19, 2026

GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories

The Hacker News

The GhostAction attackers have escalated their tactics by embedding a credential-stealing malware within a fake font file, spreading it across 94 compromised GitHub repositories. This move marks a shift from their previous method of injecting malicious workflows into GitHub Actions. The new approach targets open-source developers, making it easier for attackers to phish for sensitive information. Researchers from OpenSourceMalware have identified this trend, which indicates that the attackers are adapting their strategies in response to security measures. This incident raises concerns about the safety of open-source projects and the potential for widespread compromise in the developer community, as the malware could easily go unnoticed in legitimate-looking files.

Oct 19, 2026

Training AIs to Solve CAPTCHAs

Schneier on Security

Researchers have developed a new system that trains artificial intelligence (AI) to solve visual CAPTCHAs more effectively. Unlike traditional CAPTCHA solvers that tackle each challenge independently, this system uses a combination of a fine-tuned YOLOv8 detector and a vision-language model (VLM) that learns from its experiences. As the AI encounters CAPTCHAs, it adapts and improves, achieving an accuracy of 85.4% across various categories. This advancement poses a challenge for CAPTCHA operators, as their attempts to disrupt the AI's performance can be countered by the VLM's ability to provide training labels. The research shows that adaptive AI can quickly recover from countermeasures, suggesting that current CAPTCHA defenses may be insufficient against evolving bot technologies.

Oct 19, 2026

Spyware found on devices belonging to prominent Serbian critics as elections loom

CyberScoop

Recent reports have confirmed that spyware has been discovered on the devices of several prominent critics in Serbia, coinciding with the lead-up to parliamentary elections. Among the targets are a university rector who supports ongoing protests and a prosecutor involved in investigating a controversial real estate development linked to former President Donald Trump. This situation raises serious concerns about the surveillance of political dissenters in Serbia, particularly as the country approaches a critical electoral period. The presence of spyware suggests that these individuals may be under threat from government or politically motivated actors aiming to suppress opposition voices. This incident underscores the broader issue of digital privacy and security in environments where political tensions are high.

Oct 19, 2026

MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks

SecurityWeek

MITRE has released version 20 of its ATT&CK framework, which now includes 15 new detection strategies to help organizations combat various cybersecurity threats. This update introduces six strategies for Enterprise systems and nine for Industrial Control Systems (ICS), along with 38 supporting analytics. Notably, the catalog addresses issues such as AI abuse, multi-factor authentication (MFA) bypass, and attacks on water utilities. These insights are crucial for defenders as they enhance the tools available for identifying and mitigating emerging threats. With more organizations relying on digital systems, understanding these tactics can help prevent significant breaches and disruptions.

Oct 19, 2026