wyhycu
Re:Wordpress.com – Russian malware hidden in home folder
on Wednesday October 18, 2023 @03:40PM (#37933718)
Update: wordpress.com has removed/replaced the file, it appears. Support case still unaddressed but root problem is solved. No more mystery posts.
Re:Wordpress.com – Russian malware hidden in home folder
on Tuesday October 17, 2023 @04:21PM (#37921014)
In case anyone else is struggling with random Russian casino posts appearing in your wordpress.com website, I found the culprit.
The instance has 2 folders. htdocs & a read-only wordpress folder with sample content with I cannot alter.
The text in the sample matches the spam posts. "./themes/organic-stax/1.4.6.1/demo/default-demo-content.xml: <content:encoded><![CDATA[Имеется множество формальностей, которые приходиться придер..." (see pastebin link for more)
I have shared this with wordpress support and they stopped replying to my emails. Now I have to check and delete any new posts every day.
Will update if wordpress.com finally addresses this.