SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Two rival hackers fought over a WordPress site, exposing a plugin zero-day

0
·1 views

A WordPress website was compromised by two separate attacker groups who clashed over control of the infected server, leaving the site broken as collateral damage. One group used an authentication bypass vulnerability in the WPMU DEV Dashboard plugin, tracked as CVE-2026-15459, to install a malicious plugin and gain access; the flaw only existed when the plugin's API key was left blank. The first group planted cloaking malware to serve spam links to search crawlers while showing normal pages to human visitors. A second group later locked out the first by overwriting .htaccess rules, prompting the original attackers to retaliate by renaming the wp-content directory, effectively crashing the site. The incident went undetected by antivirus software, which scanned 373 files and flagged nothing, and was only unravelled through careful analysis of server access logs and database records.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Technical SEO for Developers: Core Web Vitals and Semantic HTML Matter More Than Keywords

Developers often dismiss SEO as a marketing concern, but a significant portion of search ranking depends on technical factors they directly control. Key issues include Cumulative Layout Shift, which occurs when page elements move unexpectedly due to undefined image dimensions, and poor use of non-semantic HTML that makes it harder for crawlers to understand page structure. Single Page Applications built with React, Vue, or Angular can hurt indexability since JavaScript rendering is slower and less reliable for bots, making Server-Side Rendering or Static Site Generation preferable. Proper meta tags, Open Graph data, and Twitter Card tags improve how content appears in search results and on social media, indirectly boosting traffic signals. Managing crawl budget through a robots.txt file and a sitemap.xml ensures search engines focus on the pages that matter most.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Virginia Residents Pay Higher Power Bills as Data Centres Consume 40% of State's Electricity

John Steinbach, a Manassas, Virginia resident, saw his electricity bill jump from roughly $100 to $281 in January 2026, despite no change in his household energy use. A Consumer Reports investigation published in March 2026 linked such spikes to the massive power demands of Data Center Alley, the world's densest concentration of server farms, which now consumes around 40 percent of Virginia's electricity. Data centres currently account for half of all new electricity demand across the United States, and residential prices rose 7.1 percent nationally in 2025 alone. Under existing utility regulations, the cost of grid upgrades needed to supply hyperscalers like Amazon, Microsoft, and Google is spread across all ratepayers, effectively shifting billions of dollars from ordinary households to some of the world's most profitable corporations. Critics argue that residents have had no say in this infrastructure expansion, raising broader questions about who should bear the cost of powering artificial intelligence.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why You Should Stop Using Redundant Instructions With Modern AI Reasoning Models

Modern AI reasoning models, as of mid-2026, are built to verify their own steps and regulate response depth without needing explicit prompts like 'double-check your work' or 'think step by step.' Overloading these models with such instructions wastes tokens, creates friction, and can cause them to over-verify or misinterpret conflicting rules. Experts recommend replacing vague directives with concrete alternatives — such as using official effort-level settings instead of 'think deeply,' and specifying exact output length rather than simply saying 'be concise.' Prompt structures should eliminate duplicate rules, define clear autonomy boundaries, and use verifiable success criteria to guide model behaviour. The advised 2026 prompting framework focuses on role, objective, constraints, output format, and stopping rules — dropping process instructions in favour of clearly defined outcomes.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Cisco ASA/FTD Zero-Day Flaw Enables Unauthenticated DoS on SSL VPN

A actively exploited vulnerability, tracked as CVE-2026-20349, affects Cisco ASA and FTD appliances, allowing unauthenticated attackers to crash the Remote Access SSL VPN service. When the firewall goes down, logging and policy enforcement stop, creating a window for malicious traffic to pass undetected. Enterprises are exposed to risks including lateral movement, loss of network visibility, and potential compliance violations. Cisco has released a patch, and administrators are advised to apply it promptly alongside hardening measures such as blocking untrusted IPs, enforcing multi-factor authentication, and segmenting VPN endpoints from critical assets. Security teams are also encouraged to monitor for anomalous traffic patterns and conduct regular DoS simulation exercises against perimeter devices.

0 comments Read more at DEV Community
Two rival hackers fought over a WordPress site, exposing a plugin zero-day · ShortSingh