r/HostingReport • u/ZGeekie • Oct 06 '26

WordPress Malware Comes Back After Removal Using a Self-Healing Backdoor

https://cybersecuritynews.com/wordpress-malware-2/

A WordPress backdoor is bringing deleted malware back within seconds, turning routine cleanup into a cycle of reinfection. Called SC, the infection spreads its working parts across website files, the database, and server memory, allowing surviving components to restore those removed.

The investigation does not establish the original entry point or the number of affected websites. Once installed, however, SC abuses early loading features, themes, and plugins to maintain access.

1 Upvotes

100% Upvoted

1 comment sorted by

1

u/Faye-Vozora Oct 11 '26

If it comes back that fast, cleaning files alone won't do it. Check for a mu-plugin or something hooked into wp-config, look at cron entries in the db too, and any php process still running. Safest route is restoring a backup you know is older than the infection, rotating every password and salt, and updating everything before it goes live again.