[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCOflP2WSqMfi1M3z14A0zXVYCSu6HxL0QV0W_cyeSi4":3},{"article":4,"iocs":48,"watch_terms":52,"solutions":53,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"2bd8e0d6-d413-4ffb-8d36-9e480f17f501","WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory","wordpress-backdoor-rebuilds-itself-after-cleanup-using-files-database-and-shared-dcd4b6","Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again. The backdoor has been codenamed SC after the \"SC_\" markers present in the injected content. Sucuri has described the malware as a \"self-healing mesh\" that's","A sophisticated WordPress backdoor, codenamed SC, has been discovered that employs a 'self-healing mesh' of persistence mechanisms. The malware resides in at least eight locations across files, the database, and shared memory, allowing any component to rebuild the others if deleted. This makes traditional cleanup methods ineffective, as the backdoor can restore itself from various sources, including RAM-based shared memory segments.","WordPress backdoor rebuilds itself using files, database, and shared memory after cleanup.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fwordpress-backdoor-rebuilds-itself.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgbdAzWwJ7WC6PL7vtBZDUWfVyYu9iIBlT3X5gZn-Yl9aRuZAEeW3RjEU81RQWsvH_7og6v7-somVgG-fR35drKy6bxLMcHdpJQAi6ydXw-m3oMxZ1hlDC7kr8Wsu0dOfRt6ZLEasAsYNGq-pzmQiBNWMbEBzqa9zYdAu16NtgIfDe3PpOvCVzGj6yFqmet\u002Fs1600\u002Fwordpress-exploit.jpg","2026-10-01T14:37:35+00:00","2026-10-01T16:00:26.544397+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"WordPress","product",{"name":21,"type":22},"Sucuri","vendor",{"name":24,"type":25},"PHP","technology",{"name":27,"type":25},"System V shared memory",{"name":29,"type":25},"Ethereum blockchain","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":34,"value":50,"context":51},"SC","Codename for the WordPress backdoor",[21,18],{"controls":54,"vendors":142},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":85,"name":86,"problem":87,"products":88},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-composable-siem","Abstract Composable SIEM","https:\u002F\u002Fwww.abstract.security\u002Fplatform","SIEM built from separate parts for collection, AI-assisted detection and tiered retention, which can be adopted one at a time.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"guardsix","Guardsix","\u002Fvendor-logos\u002Fguardsix.png","guardsix-siem","Guardsix SIEM","https:\u002F\u002Fguardsix.com\u002Fproduct\u002Fsiem","SIEM with automation, developed and hosted in Europe.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"slug":114,"name":115,"problem":116,"products":117},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":159},"self-healing-wordpress-backdoor-defeats-standard-cleanup-methods","Self-Healing WordPress Backdoor Defeats Standard Cleanup Methods","A highly sophisticated WordPress backdoor dubbed 'SC' uses a multi-layered 'self-healing mesh' that persists across files, the database, and RAM-based shared memory segments simultaneously. Traditional remediation approaches—such as deleting infected files—are rendered ineffective because any surviving component can silently reconstruct the others. This matters because defenders may believe a system is clean after partial removal, while the attacker retains full access. The use of shared memory as a persistence vector is particularly concerning as it survives file scans but not reboots, highlighting how attackers now exploit overlooked system layers. Thorough eradication requires understanding all persistence mechanisms before any cleanup action is taken.",[148,149,150,151,152,153,154,155,156,157,158],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 8: Audit Log Management","CIS Control 10: Malware Defenses","CIS Control 11: Data Recovery","NIST SP 800-61 Rev. 2: Computer Security Incident Handling (Eradication & Recovery phases)","NIST SI-3: Malicious Code Protection","NIST SI-7: Software, Firmware, and Information Integrity","NIST CP-9: Information System Backup","ITIL: Problem Management – Root Cause Analysis","OWASP WordPress Security Best Practices","GDPR Article 32: Security of Processing (integrity and confidentiality obligations)",{"CIS Control 11: Data Recovery":160,"CIS Control 10: Malware Defenses":161,"CIS Control 8: Audit Log Management":162,"NIST CP-9: Information System Backup":163,"NIST SI-3: Malicious Code Protection":164,"OWASP WordPress Security Best Practices":165,"ITIL: Problem Management – Root Cause Analysis":166,"CIS Control 2: Inventory and Control of Software Assets":167,"NIST SI-7: Software, Firmware, and Information Integrity":168,"GDPR Article 32: Security of Processing (integrity and confidentiality obligations)":169,"NIST SP 800-61 Rev. 2: Computer Security Incident Handling (Eradication & Recovery phases)":170},"Asks for data recovery, such as restoring from clean backups when cleanup fails.","Asks for malware defences, including scanning files, database and memory for the backdoor.","Asks for audit logs, which help trace how the backdoor reinfects files and database.","Requires backups, allowing restoration to a clean site rather than partial cleanup.","Requires malicious code protection, covering malware hidden in database and shared memory.","Provides WordPress hardening guidance, reducing the chance of backdoor installation.","Asks for root cause analysis, so the initial entry point is found and closed.","Asks for a software inventory, so unexpected files and plugins hiding the SC backdoor are noticed.","Requires integrity checks, which detect when the backdoor rewrites site files.","Requires integrity and confidentiality of personal data on compromised sites.","Gives eradication and recovery guidance, needed because deleting files alone does not remove SC."]