Threat reports

Quarterly threat intelligence.

Long-form research from the RedSecLabs team on what we are seeing across compromised WordPress sites, trends, families, and the techniques attackers are reaching for now.

Q1 · 2026

Trojanized plugin updates: how supply-chain attacks reached 1,200+ WordPress sites this quarter

Three families of legitimate plugins whose update routines were compromised, and the detection chain that flagged them. Includes anonymised case studies.

Q4 · 2025

Database-resident malware: a year of growth in WordPress payloads with no file footprint

Year-end analysis of malware stored as wp_options rows and serialised post meta. What changed, what to watch in 2026.

Q3 · 2025

Web shells in mu-plugins: an underexposed corner of the WordPress filesystem

Why must-use plugins are an attractive hiding spot, and statistical analysis of how often they are touched in real compromises.

Q2 · 2025

Context-aware backdoors: malware that hides from scanners running locally

Examples of malicious code that activates only on specific cookies, user-agents, or referrers, and why static analysis misses them.

Get the next report

Quarterly threat reports straight to your inbox.

One email per quarter. Only when we publish. No marketing.

Quarterly threat reports straight to your inbox.

Cookie Preferences