Admin Menu Editor Pro Supply Chain Attack Backdoors 1,500 WordPress Sites

·4 views

The official distribution infrastructure of the WordPress plugin Admin Menu Editor Pro was compromised, allowing attackers to embed malicious code into versions 2.35 and parts of 2.36 of the plugin. The tampered updates deployed a web shell via a rogue PHP file and created hidden administrator accounts on affected sites, impacting an estimated 1,500 WordPress installations across roughly 230 customers. The breach persisted even after the developer pulled version 2.35 and issued version 2.36, as the distribution server itself remained compromised at the time. Affected sites show signs of ongoing persistence including hidden users, rogue MU plugins, database modifications, and PHP files that may survive plugin deletion. The developer has advised removing both affected versions, auditing the wp_users table directly, and restoring from backups predating September 14, 2026.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Java Library Fletch Promises Faster XML Extraction Without Full Document Parsing

A Java developer has released Fletch, an open-source library designed to extract values from XML documents without materializing the entire document tree in memory. Traditional Java XML approaches such as DOM and JAXB decode and allocate every element and tag name regardless of whether the data is needed, creating significant garbage-collection overhead at scale. StAX offers streaming as an alternative but produces verbose, difficult-to-maintain code. Fletch addresses this by letting developers declare only the fields they need, after which the engine makes a single pass over the raw bytes to extract just those values. The library targets high-volume XML workloads common in e-invoicing, financial messaging, and legacy SOAP services, and is available via Maven and Gradle.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A $1,200 AI Training Run Outperformed Postgres Query Planning by 81 Percent

A researcher trained a 4-billion-parameter model on two second-hand RTX 3090s for just $1,200, producing database query plans 81 percent faster than PostgreSQL on the Join Order Benchmark. The model, a LoRA adapter weighing only 42.5 megabytes, was fine-tuned using supervised learning and reinforcement learning on the open-weights Qwen 3.8 4B architecture. Starting from near-useless baseline performance, reinforcement learning with measured execution times as a reward signal pushed the model to a 1.81x geometric mean speedup and a 44.7 percent reduction in total workload latency. The experiment highlights that domain-specific AI breakthroughs may hinge more on training methodology than on large-scale infrastructure, even as the Philippines pursues a $34.4 billion AI infrastructure roadmap targeting a 30-fold expansion in data center capacity by 2033. The contrast between the modest $1,200 experiment and billion-dollar national AI investments raises questions about where the true bottlenecks in AI development actually lie.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Ops Lead at Knowverse Outlines Real-World Challenges of Scaling AI in Production

An AI Operations Lead at Knowverse, a company specializing in AI adoption and scaling, has shared a detailed account of recurring operational pain points encountered while deploying AI tools in production. The team runs a multi-provider LLM fallback chain spanning Groq, Cerebras, OpenRouter, and Cloudflare AI, but faces issues with latency spikes, inconsistent token limits, and fragmented monitoring across providers. Human-in-the-loop review workflows are backlogging as usage grows, with no reliable prioritization system and editor corrections not feeding back into model fine-tuning pipelines. Serving clients in regulated industries adds further complexity, as data privacy requirements conflict with the need for detailed debug logs when using public cloud inference endpoints. The post also highlights difficulties in quantifying AI-driven productivity gains and ensuring AI-generated code meets the same quality standards as human-written code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Beyond console.log: Advanced Node.js Debugging Tools and Techniques

Node.js developers often rely on console.log for debugging, but this approach falls short with async errors, intermittent bugs, or deeply nested objects. The built-in V8 inspector, activated via the --inspect flag, enables breakpoints, step-through execution, and accurate call stacks viewable directly in Chrome DevTools. Conditional breakpoints help isolate bugs in high-frequency loops, while debugger statements act as toggleable breakpoints that are safe to commit temporarily during a session. For performance issues, Node's --cpu-prof and --heap-prof flags generate profiles loadable in Chrome DevTools, helping identify slow functions and memory leaks. Structured error properties like err.code and utilities such as console.dir with depth: null provide clearer, more actionable diagnostic information than simple message strings.

0 comments Read more at DEV Community