Supply Chain · Watch Monday · 10 August 2026 End-of-day synthesis 4 watches · 2 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — Two unrelated ecosystems — VS Code extensions and WordPress plugins — got hit by the same trick today: poison the trusted side-channel a package polls, not the package itself.

Two items, both critical, and both variations on the same theme: attackers reaching for a component in the supply chain that most defenders don't think to inventory.

This morning's find was the "Solidity Pro" VS Code extension, tracked by Datadog as MUT-9332, which beacons to a C2 and rewrites browser shortcuts to load a malicious Chromium extension on every launch — a wallet and credential stealer riding on developer-tooling trust. This evening's is structurally similar but on a different ecosystem entirely: a threat actor poisoned the JSON banner feed that seven BdThemes WordPress plugins (Element Pack, Prime Slider, Ultimate Post Kit, and others) pull into every admin dashboard, using it to silently mint rogue administrator accounts and drop a hidden `?_wplogin=` backdoor — all without touching a single line of plugin code. Neither campaign compromised the artifact developers or admins actually vetted; both compromised a side-channel the artifact trusted by default, which is exactly what file-integrity checks and code review don't catch.

→ Operational priority for the night if you run any BdThemes plugin, check `wp-content/mu-plugins/` for files backdated to September 2025 and audit the WordPress users table for admin accounts you don't recognize before end of day.

18:00 ET · First Watch

Critical · BleepingComputer · Wordfence ·added 18:00 ET

BdThemes plugins supply-chain hack creates rogue WordPress admins

Seven BdThemes WordPress plugins (Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, Smart Admin Assistant) pull a shared JSON banner feed from a DigitalOcean Spaces bucket; the feed was poisoned to fire JavaScript in any logged-in admin's wp-admin session, silently mint a new administrator via the REST API, and drop two must-use plugins backdated to September 2025 — a `?_wplogin=` magic-login backdoor and a module that hides the rogue account from the users list. No plugin code was altered, so file-integrity checks and code review both miss it entirely; the trust boundary that broke was the third-party data feed the plugin polls, the same shape as a compromised CDN or config-as-code channel. Wordfence flagged it August 7 and the plugins are pulled from WordPress.org pending investigation — if you run any of them, check `wp-content/mu-plugins/` for files dated September 2025 and audit the users table for admins you don't recognize.

06:00 ET · Morning Watch

Critical · The Hacker News · Datadog Security Labs (MUT-9332) ·added 06:00 ET

Malicious "Solidity Pro" VS Code extensions beacon to a C2 and hijack browsers to steal wallets and credentials

The "Solidity Pro" VS Code extension (helper-beeps.solidity-pro, web3devtoolsx.solidity-pro) runs obfuscated JS that beacons to a solidity[.]bot C2, then pulls PowerShell payloads that drop an encrypted Python stealer or rewrite Chrome/Edge shortcuts so a malicious Chromium extension loads on every browser launch — Datadog Security Labs is tracking the cluster as MUT-9332. This is the extension-marketplace version of a poisoned npm package: developers install it for legitimate Solidity tooling and end up with a persistent wallet, API-key, and credential harvester wired into their daily browser. Both packages are pulled from Open VSX but the web3devtoolsx/solidity-pro GitHub repo is still live — if either was installed, check for modified browser shortcuts and rotate any wallet keys or credentials used on that machine.