110 points by taubek 8 hours ago | 5 comments
neomantra 3 hours ago
I really appreciate that this supply breach was discovered by a diligent system operator (tracking a slow HTTP request).

Similarly, the xz breach was uncovered by a diligent developer looking at quirky SSH login performance regressions.

mlyle 37 minutes ago
Malware used to be pretty obvious for performance penalties.

But we are getting so much faster, and networks are doing so much weird inscrutable stuff now that it’s a lot harder at baseline. And, of course, the baddies are getting sneakier, too, and we are building systems from more components from more diverse sources.

I worry about the long term picture a lot; does all of infrastructure become a little untrustworthy at baseline?

SV_BubbleTime 15 minutes ago
> I worry about the long term picture a lot; does all of infrastructure become a little untrustworthy at baseline?

Isn’t that a scenario that is better?

If you stop trusting potentially insecure systems you start developing hard and solid ones.

I don’t worry about deepfakes or AI malware, I welcome it. It’s stupid that we have insecure systems like unencrypted emails, social security cards, unsigned documents, passwords in PIN codes alone, etc.

mpol 6 hours ago
Using a nonce before checking the form would have prevented much of the problems described. Or stated differently, it would suddenly require lots of manual labour.
jimjambw 4 hours ago
I’m from a technical background and so I understand this but being a Brit sentences like this are always funny to me
theglenn88_ 4 hours ago
Not On Normal Courtyard Exercise
stuartjohnson12 2 hours ago
Basically A Creative Kind of Reverse Origin Naming You Make
astura 3 hours ago
For those who didn't understand this comment (like me)

Nonce is also British slang for alleged or convicted sex offenders, especially ones involving children.

4ndrewl 2 hours ago
Makes some discussions with non-technical stakeholders interesting.
MarkusQ 1 hour ago
That's why you should call them pervs (per-instance values).
doodlebugging 1 hour ago
Nice work to identify this malware and take action against it spreading. The article does have one small error though that made me do a double-take.

The most recent update at the top of the page should probably be "Update 7-12-2025 06:00 UTC" instead of the current future date of 08-11-2025. I think the author incremented the wrong digit.

giingyui 5 hours ago
Should say what plugin it is.
Etheryte 5 hours ago
It's in the title? It's the official GravityForms plugin, supposedly version 2.9.13 fixes the issue, but the changelog [0] doesn't even mention the breach.

[0] https://docs.gravityforms.com/gravityforms-change-log/

giingyui 5 hours ago
The way it’s worded in the article it sounds like there are multiple plugins available in that domain.

> one of the plugins that they are trying to download from the official gravityforms.com domain

It’s common for certain plugins to have… plugins of their own. For example if you have a form created with gravityforms and you want to connect it to a CRM or something, there is a screen inside the plugin settings to install it. Which is why I asked. (I don’t know if that’s the case with gravityforms.)

redrove 4 hours ago
Honestly it still required a web search on my part to figure out it’s a WordPress plugin. That should be in the title.
autoexec 4 hours ago
Any time I read the words vulnerable and plugin I just assume WordPress is involved somehow. I'm convinced that the internet would be instantly more secure if the entire platform died off.
ChrisMarshallNY 3 hours ago
It would.

It also would be a lot less useful. A lot of content is published through WordPress.

I suspect an effective approach would be encouraging ways to make WP more secure, or publish a secure platform that can easily be transitioned from WP.

iambateman 1 hour ago
How is this even possible? Is the most likely explanation that a bad actor within GravityForms snuck something in?

I didn’t see anything in the article but I may have missed it.

Y-bar 1 hour ago
Could have been a compromised CI pipeline like Jenkins or a developer machine with a malware infection.