Rank Math PRO Supply Chain Attack and H3C Router Exploits

On 20 October 2026, two critical security incidents demand immediate attention from UK small businesses. First, a supply chain attack compromised Rank Math PRO, a widely used WordPress SEO plugin, delivering malware through legitimate update channels during an eleven-hour window on 15-16 October. The malware establishes persistent backdoors, exposes credentials, and rebuilds itself on page visits, requiring full site investigation rather than simple file deletion. Second, two vulnerabilities in the H3C Magic NX15 router, both scoring 9.9 on the CVSS scale, enable unauthenticated remote code execution with publicly available exploits. These incidents target precisely the infrastructure small businesses install and forget: plugins on automatic update and network hardware left unpatched for months or years. Neither attack required sophisticated access. Both exploited the gap between deployment and ongoing oversight. This episode provides practical guidance on checking WordPress update logs, investigating compromised sites, auditing router firmware, and building the basic asset inventory that transforms reactive panic into measured response. The common thread is inattention to background infrastructure, and the fix is process, not technology.

Chapters

• Intro Corrine introduces the episode and frames two active compromises: one targeting WordPress sites, one targeting network infrastructure. Neither provided advance warning, and both exploit the gap between deployment and ongoing oversight.
• Rank Math PRO Supply Chain Attack Detailed analysis of CVE-2026-111862, a supply chain attack on Rank Math PRO WordPress plugin. Between 15-16 October 2026, malware was distributed through legitimate update channels during an eleven-hour window. The malware establishes persistent backdoors, contacts command-and-control infrastructure, rebuilds itself on page visits, and exposes WordPress and database credentials. Affected sites require full compromise investigation, not simple file deletion. Guidance provided on checking update logs, auditing sites, rotating credentials, and the competitive value of proactive oversight for agencies.
• CTA Brief call to action encouraging listeners to follow the show, leave reviews, and share the episode with others who manage WordPress sites or network infrastructure.
• H3C Magic NX15 Router Vulnerabilities Examination of two critical vulnerabilities in the H3C Magic NX15 router, CVE-2026-112370 and CVE-2026-112371, both scoring 9.9 on CVSS. Both enable unauthenticated remote code execution via OS command injection and code injection flaws, with public exploits already in circulation. Routers in attacker hands sit at network boundaries, enabling traffic interception, connection redirection, and persistent access. Practical guidance on identifying affected devices, checking for firmware updates, restricting internet-accessible admin interfaces, and building a basic network device inventory.
• Outro Corrine closes by emphasising the common thread: both incidents exploited infrastructure that businesses deployed, trusted, and stopped monitoring. The fix is ongoing oversight through basic processes like checking update logs, knowing firmware versions, and maintaining asset inventories before incidents occur.

Links

• https://rankmath.com
• https://rank1cdn.com