Mac Developer: Mysterious spike in WordPress hacks silently delivers ransomware to visitors | Ars Technica
It's not yet clear how the WordPress sites are getting infected in the first place. It's possible that administrators are failing to lock down the login credentials that allow the site content to be changed. It's also feasible that attackers are exploiting an unknown vulnerability in the CMS, one of the plugins it uses, or the operating system they run on.
Labels: security policy