Ankura CTIX FLASH Update – May 4, 2026

Malware Activity

Hidden Threats in Trusted Software

Two (2) recent incidents highlight how widely trusted software components can harbor stealthy, long-running vulnerabilities. One (1) popular WordPress plugin (Quick Page/Post Redirect, ~70,000 installs) was quietly hijacked by attackers around 2020–2021, inserting a hidden self-update mechanism that delivered a rogue plugin version and injected malicious code into sites for about five (5) years until a security scan in 2026 finally caught it. Meanwhile, a newly disclosed Linux kernel flaw dubbed “Copy-Fail” (CVE-2026-31431) had been lurking in core code since 2017. This affected essentially all major Linux distributions and allows any unprivileged user to gain root privileges by corrupting the operating system’s in-memory file cache. For example, altering the cached copy of a setuid root program like “su” and allows it to run their own code. Both cases underscore how supply-chain compromises and subtle logic flaws in core software