Skip to main content
rfxn

Research · March 27, 2026

WordPress Supply Chain Attacks: BuddyBoss, Gravity Forms, and the Trust Problem

Three premium plugin supply chains compromised in 12 months. Attackers are targeting vendor update infrastructure, and we publish 10 new LMD signatures to catch current and future backdoors.

Threat Advisory
3 vendor update channels compromised
10 new LMD detection signatures
Generic rules for future supply chain backdoors
IOCs and remediation playbook
maldetmalwarewordpresssupply-chain
Active Servers (30d)

365.7k

Requests (30d)

36.35M

GitHub

2,104

Deployed across government, defense, education & enterprise networks

govNISTgovNOAAgovNIHgovUNAMdefenseNATO CCDCOEeduStanford UniversityeduHarvard UniversityeduNational Taiwan UniversityeduCity University of New YorkresearchDFNresearchRENATERresearchJANETresearchSURFnetresearchRedIRISresearchGARRresearchUNINETTresearchSWITCHenterpriseAmazon Web ServicesenterpriseMicrosoftenterpriseGoogleenterpriseDeutsche TelekomenterpriseVodafoneenterpriseTelefonicaenterpriseOrangeenterpriseCogententerpriseIONOShostingLiquid WebhostingVultrhostingDigitalOceanhostingHetznerhostingOVHhostingNexcesshostingContabohostingLeasewebhostingBluehostgovNISTgovNOAAgovNIHgovUNAMdefenseNATO CCDCOEeduStanford UniversityeduHarvard UniversityeduNational Taiwan UniversityeduCity University of New YorkresearchDFNresearchRENATERresearchJANETresearchSURFnetresearchRedIRISresearchGARRresearchUNINETTresearchSWITCHenterpriseAmazon Web ServicesenterpriseMicrosoftenterpriseGoogleenterpriseDeutsche TelekomenterpriseVodafoneenterpriseTelefonicaenterpriseOrangeenterpriseCogententerpriseIONOShostingLiquid WebhostingVultrhostingDigitalOceanhostingHetznerhostingOVHhostingNexcesshostingContabohostingLeasewebhostingBluehost
$git clone https://github.com/rfxn/linux-malware-detect.git && cd linux-malware-detect && ./install.sh

Recent GitHub Activity

View all

Featured Projects

View all

Quick Start

Get up and running in minutes. All tools install from source with a single command.

LMDLinux Malware Detect
bash
$ git clone https://github.com/rfxn/linux-malware-detect.git && cd linux-malware-detect && ./install.sh
APFAdvanced Policy Firewall
bash
$ git clone https://github.com/rfxn/advanced-policy-firewall.git && cd advanced-policy-firewall && ./install.sh
BFDBrute Force Detection
bash
$ git clone https://github.com/rfxn/brute-force-detection.git && cd brute-force-detection && ./install.sh

Built for Real-World Linux Security

Threat-Driven Design

Built from real malware data collected at the network edge. Every detection signature comes from active threats seen in production hosting environments, not theoretical research.

Shell-Native & Lightweight

Pure bash with minimal dependencies. No agents, no daemons eating resources, no runtime interpreters. Runs on any Linux system from embedded devices to enterprise servers.

Community-Sustained

20+ years of open source development under GPL v2. No venture funding, no enterprise upsells. Sustained by the community of sysadmins who rely on these tools daily.

Protection Stack

Three tools, one defense-in-depth strategy. Layer them together for comprehensive Linux security.

Layer 1

Malware Detection

LMD

Scan & quarantine threats from real hosting threat data

Layer 2

Firewall Policy

APF

Stateful iptables filtering with reactive address blocking

Layer 3

Intrusion Prevention

BFD

Block brute-force auth attacks with modular log parsing

Connect

About

Support Open Source Security

R-fx Networks projects are entirely community-funded. If these tools help protect your infrastructure, consider contributing.