js2484

Hi @wesleyvdbrink,

Your breakdown of the payload itself, including the attacker’s C2 domain, the rogue admin creation, and the file modification attempts is accurate. We detailed these exact indicators in our official postmortem. However, it is important to note that these specific administrative actions only occurred on a subset of affected sites, as they strictly required a logged-in administrator to view an affected wp-admin page while the payload was active.

I do want to clarify one critical technical distinction for anyone reading this thread: there was no “backdoor” on our servers. >
A backdoor implies persistent hidden access. What actually happened was that attackers utilized “Copy Fail” (CVE-2026-31431), a vulnerability in the Linux kernel itself in order to get root access to the machines.

The weaponized exploit for this vulnerability was made public at the very end of April. Our API server was hit in the early morning on May 1st, shortly after the script dropping on the internet, before many Linux distributions even had stable patches available. Microsoft and major security firms have documented how this exact vulnerability compromised millions of cloud Linux workloads globally the same week.

We have patched the kernel, rotated all keys, and released v2.163, so the plugin won’t execute an unescaped payload that way again.