October 20, 2026
- Official Rank Math PRO packages delivered a persistent WordPress backdoor during an 11-hour compromise window. Version 3.0.123 downloaded or installed between October 15 at 20:02 UTC and October 16 at 07:12 UTC could create hidden administrators and scheduled tasks, execute commands, and expose database credentials, API keys, SSH keys, and cloud credentials. Rank Math released clean version 3.0.124, but says sites where the malicious build was activated should be treated as compromised rather than merely updated. BleepingComputer · Supply Chain, Cloud & Identity