Word Press Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
Summary: Sucuri researchers documented a WordPress backdoor codenamed SC that keeps identical copies in at least eight locations across files, the database, and shared memory, and each copy can rebuild all the others. The malware hides from the admin plugins screen, communicates with a command-and-control server over the Ethereum blockchain, creates a hidden administrator account, and registers cron hooks with randomized names to redeploy on schedule.
Key Takeaway: Cleaning every file on disk does not end this infection: the next page load restores the full set from the database or a shared-memory segment that lives in RAM and, on shared hosting, can be owned by a different account. There is no single component you can remove to stop it.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-1581
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026