Supply Chain Attacks Are Escalating — Is Your Business Exposing Data Through Vendors?

The ShapedPlugin Backdoor: Your "Trusted" Plugin Update Is the Attack

On June 22, 2026, Wordfence revealed that multiple Pro plugins from ShapedPlugin — Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro — had been backdoored after attackers compromised the vendor's build and distribution pipeline. The malicious code was pushed through official licensed update channels, not some shady third-party site. Customers who paid for legitimate licenses and installed updates directly from the vendor received malware.

The backdoor was assigned CVE-2026-49777 with a CVSS score of 10.0 — maximum severity. Once activated, the compromised plugin fetched a remote payload, installed itself as a fake plugin hidden from the WordPress admin panel, and captured credentials in plaintext along with two-factor authentication codes. It also extracted the full contents of wp-config.php (database credentials, authentication keys), all administrator accounts, SMTP plugin credentials, and three months of WooCommerce order data including payment method breakdowns. Then it deleted itself to cover its tracks.

How bad was it? Any WooCommerce site running these Pro plugins had its database credentials, admin accounts, and customer payment data exposed. The attacker also established persistent access via web shells and custom REST endpoints.

How it could have been prevented: ShapedPlugin's build pipeline lacked integrity verification — no signed releases, no checksum validation on distributed packages. The vendor has since confirmed the incident and is reviewing distribution processes, but the damage is done for every site that already installed the poisoned updates.

What to do this week: Audit every WordPress plugin on your sites. Check if you're running Product Slider Pro (before v3.5.4), Real Testimonials Pro (v3.2.5), or Smart Post Show Pro (before v4.0.2). If so, reset all passwords, revoke and regenerate 2FA secrets, review admin accounts for unauthorised additions, and check SMTP configurations for modified credentials. Going forward, demand that any plugin vendor you rely on provides signed updates and publishes their build-pipeline security controls.

FortiBleed: 110 Million Credentials Stolen Through Your Firewall

Reported June 23, 2026 by SOCRadar, the FortiBleed campaign has been active since February 2026 and has targeted over 430,000 FortiGate firewalls globally. A Russian-speaking initial access broker deployed a custom Golang tool called FortigateSniffer onto compromised firewalls, which passively captures authentication traffic across 24 protocols — including Kerberos, RADIUS, SMB, LDAP, RDP, MS-SQL, MySQL, and PostgreSQL.

The numbers are staggering: 110 million credentials identified, including 14.8 million RADIUS credentials, 89 million MySQL authentication tokens, 924,000 NTLM hashes, and 130,000 Kerberos hashes. Attackers ran 659 credential-harvesting pipelines on May 31 and June 15 alone.

Critically for Australian SMBs: SOCRadar noted the campaign shows "a heavy focus on Small and Medium Businesses (SMBs) with fewer than 200 employees." The IT services sector is a key target because compromised service providers create access paths into customer environments — your MSP or IT consultant's firewall gets popped, and suddenly your entire network is exposed.

How bad was it? This isn't a single breach — it's a mass harvesting operation. Any business whose FortiGate firewall was compromised has had every authentication credential passing through that device captured. That includes credentials to your Active Directory, databases, VPN, email, and internal services.

How it could have been prevented: Disable administrative SSH access on internet-facing FortiGate firewalls. Enforce MFA on all admin panels. Restrict management interfaces to specific IP ranges. Patch FortiOS to the latest version. Monitor for unauthorised diagnostic command usage.

What to do this week: If you operate FortiGate firewalls, immediately check for signs of compromise — unauthorised SSH sessions, unexpected diagnostic sniffer processes, or unfamiliar scheduled tasks. Rotate all credentials that may have transited the device. Demand that your IT provider or MSP document their firewall hardening practices. If they can't, find a new provider.

Atomic Arch: 400+ Open-Source Packages Weaponised Against Developers

On June 12, 2026, Sonatype revealed that attackers had hijacked over 400 packages in the Arch User Repository (AUR) by adopting abandoned packages whose maintainers had walked away. They rewrote the build scripts to execute a malicious npm package called atomic-lockfile during installation, which deployed a Rust-based credential stealer.

The malware targeted developer workstations and build systems specifically, harvesting: browser cookies and tokens from Chromium-based browsers, session data from Slack/Discord/Teams, GitHub and npm tokens, SSH keys, Docker credentials, and OpenAI API keys. Stolen data was exfiltrated over HTTP to temp.sh with command-and-control through a Tor onion service. With root access, it could also load an eBPF rootkit to hide itself from detection tools.

How bad was it? Any developer who built or updated an affected AUR package on or after June 11 potentially had their credentials stolen. Those credentials include access to source code repositories, CI/CD pipelines, cloud infrastructure, and API keys — the keys to your entire digital kingdom.

How it could have been prevented: The AUR trust model allows anyone to adopt orphaned packages. There's no verification that the new maintainer is who they claim to be, and the spoofed git metadata made changes appear to come from long-standing maintainers. This is a systemic trust failure, not a software bug.

What to do this week: Inventory every third-party and open-source dependency your developers install. If anyone on your team uses Arch Linux with AUR packages, audit their recent installs against the affected-package lists. More broadly: enforce dependency pinning with checksums, use private package registries with approval workflows, and rotate any developer credentials that may have been exposed. Treat open-source packages as third-party vendors — because they are.

What to Demand From Every Vendor This Week

The pattern across all three attacks is identical: the trust signal was the attack vector. ShapedPlugin customers trusted the official update channel. FortiGate owners trusted their firewall vendor's defaults. AUR users trusted package names and maintainer history. In every case, that trust was exploited.

Here's what you should be putting in your vendor contracts and security questionnaires:

1. Signed updates with checksum verification — every software vendor must cryptographically sign releases. If they can't, ask why.
2. Build-pipeline security documentation — demand evidence of how their build and distribution process is secured. CI/CD pipelines are now primary attack targets.
3. Breach notification timelines — your contracts should require notification within 72 hours of a security incident, not "as soon as commercially reasonable."
4. Right to audit — for critical vendors, you need contractual rights to review their security posture, not just take their word for it.
5. Dependency transparency — vendors should disclose their own third-party dependencies. You can't assess supply chain risk if you can't see the chain.

FAQ

Conclusion

Supply chain attacks work because they exploit trust you've already extended. The ShapedPlugin backdoor, FortiBleed credential harvesting, and Atomic Arch package hijacking all happened in June 2026 — and they're not anomalies, they're the trajectory. Every third-party tool, plugin, package, and managed service provider in your stack is a potential entry point.

Your action items this week: audit your WordPress plugins, check your firewall hardening, inventory your open-source dependencies, and send your critical vendors a security questionnaire asking the five questions above. If a vendor can't answer them, you have a decision to make.

Don't wait for your vendor's breach to become your breach. Visit consult.lil.business for a free cybersecurity assessment — we'll map your third-party risk exposure and give you a prioritised action plan.

References

1. ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack — The Hacker News
2. FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation — The Hacker News
3. Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit — The Hacker News
4. NIST Cybersecurity Supply Chain Risk Management (C-SCRM)
5. Australian Cyber Security Centre — Supply Chain Security Guidance

Verifier warning: verifier could not run (PluginLlmTrustError).