Today’s Field Note

The theme today is the update channel turning hostile. Attackers hijacked a contributor’s GitHub account to poison five OVHcloud CLI releases (live 94 minutes, long enough), backdoored the Rank Math PRO WordPress plugin with a self-restoring implant between Oct 15-16, and tampered with AOMEI Backupper’s update servers to push a RAT. Separately, CVE-2026-110936 (CVSS 8.4) in Siemens Software Center is under active exploitation via ClickFix lures pairing a signed binary with a malicious DLL, and Plex2Shell exploitation began one day after the PoC dropped. The common thread: the signed, trusted thing you auto-update is the delivery vehicle. Assume anything pulled through these channels in the affected windows is tainted until proven otherwise.

Today’s Action

  • Audit any machine that ran the OVHcloud CLI pulled Oct 19 (12:47-14:21 UTC); rotate every secret on that disk, those downloads were secret-stealers.
  • Treat any WordPress site that installed Rank Math PRO 3.0.123 (Oct 15 20:02 to Oct 16 07:12 UTC) as compromised: pull it, hunt for the backdoor, rotate admin and DB creds.
  • Reimage hosts that updated AOMEI Backupper in the tampering window; the RAT grants remote access, cleanup is not enough.
  • Patch Siemens Software Center for CVE-2026-110936 now and hunt for rogue DLLs sideloaded next to the signed binary; brief staff on ClickFix “paste this command” lures.
  • Patch Plex Media Server against the Plex2Shell chain today; PoC is public and exploitation is live.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Your updater has a login. Someone else used it.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.