Author: admin

A sophisticated supply chain attack has compromised the official GravityForms WordPress plugin, allowing attackers to inject malicious code that enables remote code execution on affected websites.

The attack, discovered on July 11, 2025, represents a significant security breach affecting one of WordPress’s most popular form-building plugins, with the malware being distributed directly through the official gravityforms.com domain.

Key Takeaways
1. A sophisticated supply chain attack compromised GravityForms version 2.9.12, injecting malware via the official plugin distribution.
2. The malware enabled remote code execution, data exfiltration, and persistent backdoor access using functions like update_entry_detail() and list_sections().
3. The malicious domain (gravityapi.org) was shut down, and the developer released a clean version (2.9.13) to stop further infections.
4. Users should update immediately and monitor for suspicious activity, especially unauthorized admin accounts or unusual PHP files.

GravityForms Plugin Hacked

The security breach was first identified by researchers at Patchstack, who received reports of suspicious HTTP requests to an unknown domain, gravityapi.org, originating from the GravityForms plugin.

The malicious domain was registered on July 8, 2025, just days before the attack was discovered, suggesting a carefully orchestrated campaign.

Initial investigations revealed that the compromised plugin version 2.9.12 contained malware that was being distributed through official channels, including manual downloads and composer installations.

However, the attack appeared to have a limited window of opportunity, as RocketGenius, the developer of GravityForms, quickly responded to remove the malicious code from new downloads.

The company confirmed they were conducting a thorough investigation into the breach, and by July 7, 2025, they had released version 2.9.13 to ensure users could safely update without the backdoor present.

Additionally, domain registrar Namecheap suspended the gravityapi.org domain to prevent further exploitation.

The malware operated through two primary vectors, both designed to provide attackers with comprehensive control over infected WordPress installations.

The first method involved a malicious function called update_entry_detail() embedded in the plugin’s common.php file, which automatically executed whenever the plugin was active.

This function collected extensive system information from infected sites, including WordPress version, active plugins, user counts, and server details, then transmitted this data to the attacker-controlled domain.

The response from the malicious server contained base64-encoded payloads that were automatically saved to the infected site’s file system, creating persistent backdoors.

The second attack vector utilized a function called list_sections() that created a sophisticated backdoor system requiring a specific API token for access. This backdoor provided attackers with extensive capabilities:

• Creating administrator accounts with full privileges.
• Executing arbitrary PHP code through eval() functions.
• Uploading malicious files to the server filesystem.
• Listing and deleting existing user accounts.
• Performing comprehensive directory traversals.
• Maintaining persistent access even after discovery.

The malware was particularly dangerous because it could execute arbitrary PHP code through eval() functions, essentially giving attackers complete control over infected websites.

The backdoor also included functionality to create new administrator accounts, effectively ensuring persistent access even if the initial compromise was discovered.

Mitigations

While the full scope of the attack remains under investigation, preliminary assessments suggest the infection was not widespread, likely due to the short timeframe during which the malicious version was available.

Major web hosting companies have begun scanning their servers for indicators of compromise, with results suggesting limited distribution.

The attack highlights the critical vulnerabilities in software supply chains, where even trusted sources can be compromised.

The sophisticated nature of the malware, with its multiple backdoors and comprehensive system access capabilities, demonstrates the advanced techniques employed by modern cybercriminals.

Security firms have identified several indicators of compromise, including suspicious IP addresses (185.193.89.19 and 193.160.101.6), malicious files (bookmark-canonical.php and block-caching.php), and the specific API token used by the backdoor system.

Organizations using GravityForms are advised to immediately update to version 2.9.13 or later, conduct thorough security scans of their WordPress installations, and monitor for any unauthorized administrator accounts or suspicious file modifications.

This incident underscores the importance of maintaining robust security monitoring and the need for enhanced supply chain security measures in the software development ecosystem.

Indicator of Compromises (IoCs):

Type	Indicator / Detail	Notes
IP Address	185.193.89.19	Potential malicious IP
IP Address	193.160.101.6	Potential malicious IP
Domain	gravityapi.org	Associated with compromise
Domain	gravityapi.io	Associated with compromise
File Path	gravityforms/common.php	Look for gravityapi.org and update_entry_detail function
File Path	includes/settings/class-settings.php	Look for list_sections function
File Path	wp-includes/bookmark-canonical.php	Suspicious file
File Path	wp-includes/block-caching.php	Suspicious file
Hash/String	Cx3VGSwAHkB9yzIL9Qi48IFHwKm4sQ6Te5odNtBYu6Asb9JX06KYAWmrfPtG1eP3	Possibly a file hash, malware signature, or unique identifier

Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now

Cybersecurity researchers at the University of Toronto have achieved a breakthrough in hardware-level attacks by successfully demonstrating GPUHammer, the first Rowhammer attack specifically targeting discrete NVIDIA GPUs.

The research, which focuses on the popular NVIDIA A6000 GPU with GDDR6 memory, represents a significant expansion of the decade-old Rowhammer vulnerability beyond traditional CPU memories.

The research team, led by Chris S. Lin, Joyce Qu, and Gururaj Saileshwar, overcame substantial technical challenges to achieve what was previously thought impossible.

Their GPUHammer attack successfully induced 8-bit flips across 4 DRAM banks on the A6000 GPU, demonstrating that Graphics-DDR (GDDR) memories are indeed vulnerable to the same disturbance attacks that have plagued CPU memories for years.

“This is the first systematic Rowhammer campaign on NVIDIA GPUs,” the researchers stated in their paper. The attack required developing novel techniques, including reverse-engineering proprietary GDDR DRAM row mappings and creating GPU-specific memory access optimizations to amplify hammering intensity.

Real-World Impact on AI Systems

The implications extend far beyond academic research. The team demonstrated that these bit-flips can cause devastating accuracy degradation in machine learning models, with drops of up to 80% observed across popular neural networks, including AlexNet, VGG16, ResNet50, DenseNet161, and InceptionV31.

This vulnerability is particularly concerning given that GPUs power the majority of AI inference workloads in both cloud and enterprise environments.

The attack targets the most significant bit of the exponent in FP16-representation weights, exponentially altering parameter values and dramatically reducing model accuracy. In some cases, models with 80% baseline accuracy were reduced to less than 0.5% accuracy with a single strategically placed bit-flip1.

The researchers faced unique obstacles in adapting traditional Rowhammer techniques to GPU architectures. GPUs have approximately 4× higher memory latency compared to CPUs and faster refresh rates, making conventional hammering approaches ineffective.

The team solved this by developing parallelized hammering kernels that leverage GPU throughput capabilities, achieving activation rates close to 500,000 activations per refresh window1.

Additionally, the proprietary nature of GPU memory mappings required innovative reverse-engineering approaches. Unlike CPUs where physical addresses are accessible, NVIDIA GPUs keep these mappings private, forcing researchers to develop new methods for identifying vulnerable memory locations1.

NVIDIA’s Response and Mitigation

Following responsible disclosure on January 15, 2025, NVIDIA issued a comprehensive security advisory acknowledging the vulnerability. The company emphasized that System-Level ECC effectively mitigates the attack when enabled, though this protection comes with approximately 6.5% memory overhead and 3-10% performance impact1.

NVIDIA’s advisory covers multiple GPU generations, including Blackwell, Ada, Hopper, Ampere, Jetson, Turing, and Volta architectures. The company strongly recommends enabling System-Level ECC on professional and data center products, noting that it’s enabled by default on Hopper and Blackwell data center GPUs.

For newer GPU generations, On-Die ECC (OD-ECC) provides additional protection. This technology is automatically enabled on supported devices, including RTX 50 series consumer cards and the latest data center products, offering built-in resistance to Rowhammer attacks.

The research highlights a critical gap in GPU security as these processors become increasingly central to AI and high-performance computing. With NVIDIA commanding approximately 90% of the GPU market share, the vulnerability potentially affects millions of systems worldwide.

The timing is particularly significant as cloud providers increasingly offer GPU time-sharing services, creating multi-tenant environments where malicious actors could potentially target other users’ AI models or sensitive data residing in GPU memory.

While the researchers focused on the A6000 GPU, similar vulnerabilities may exist across other GPU architectures and memory types. The team noted that A100 GPUs with HBM2e memory and RTX 3080 devices showed no bit-flips in their testing, though this may be due to different threshold levels or enhanced mitigations rather than immunity.

The research underscores the importance of hardware-level security considerations in AI system design and the need for robust mitigation strategies as GPU computing continues to expand across critical applications.

Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now 

You can save $50 on the best-selling Omnilux LED face mask during the brand’s Prime Glow Sale—just $10 shy of the best price we saw for the mask last Black Friday. One of our top picks, the Omnilux Contour Face is lightweight and easy to use with a contoured design that fits snugly around your features—perfect for beauty lovers looking for something simple but effective. The set also includes multiple power adapters, so you can take it abroad while traveling this summer.

After testing a variety of popular LED face masks, our beauty team named the Omnilux Contour Face the best silicone LED face mask thanks to its easy-to-follow instructions and overall fit. Most importantly, its combination of red light and near-infrared light therapy left our tester’s skin looking even and glowy after months of use. If you’re looking for more beauty favorites, the Omnilux sale also includes up to $200 off three full-sized devices (a great gifting opportunity), 15% off mini devices and topical skincare and $92 off limited-time bundles.

Omnilux LED Mask Sale: Save Up To $200

Supervising deals and coupons editor, Kara Cuzzone, also gives the mask high marks. “The Omnilux Contour Face is the best LED mask I’ve tried. I like that it’s lightweight and flexible, so it’s easy to pack and take on the go,” she says. “Plus, each session is only 10 minutes. After I use it, my skin looks noticeably brighter and my redness is less visible.” Commerce editor and co-author of this story Katherine Louie has been using this mask consistently for several months and says she’s noticed less redness, fewer breakouts and less inflammation overall.

---

Does The Omnilux LED Face Mask Really Work?

Yes, multiple Forbes Vetted editors and writers tested the Omnilux Contour Face and found it provided benefits including brightening, evening out skin tone and decreasing redness. As dermatologist Dr. Corey L. Hartman previously told Forbes Vetted, the device is FDA-cleared, and the brand supports its claims with clinically reviewed and published research. The mask features 132 medical-grade LEDs and optimized wavelengths of red and near-infrared light to deliver noticeable changes to the skin.

How Long Does It Take To See Results From Omnilux?

As long as users are consistent with their applications—wearing the mask three to five times per week for 10 minutes at a time—Omnilux says there should be visible results within four to six weeks. After the six-week period, users can move into routine maintenance treatments, though frequency required depends on individual lifestyle choices and long-term skin goals.

Can I Use The Omnilux LED Mask Every Day?

Omnilux advises wearing the LED mask three to five times per week to start. If you have more sensitive skin, you may prefer to start at three times per week and gradually build up to five times per week. Since everyone’s experience with light therapy can be different, it’s a good idea to consult with a dermatologist or esthetician before starting, especially if you’re unsure how your skin might react.

Ahead of a launch in late August, more details on the Pixel 10 and Pixel 10 Pro handsets are becoming clear. This week, we have more of an idea on Google’s pricing strategy, and it looks both familiar and aggressive.

Pixel 10 And Pixel 10 Pro Pricing

The details come from WinFuture’s Roland Quandt. European pricing shows that the Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL and Pixel 10 Pro Fold will all go on sale with the same pricing for the same storage options. That means the Pixel 10 will start at €899 with 128 GB storage, the Pixel 10 Pro starting at €1,099 for 128 GB, the Pixel 10 Pro XL at €1,299 for 256 GB and the Pixel 10 Pro Fold at €1,899 for 256 GB,

Of note, there is no listing for a 128 GB variant of the Pixel 10 Pro XL; for 2025 the Pro XL storage starts at 256 GB in Europe. It may be that availability in the territory is limited, or Google has decided to drop this option. That should become clear as we get closer to the launch date.

With smartphone prices sneaking up across the various portfolios, Google retaining the pricing on the Pixel family can be seen as an aggressive push to

The Pixel 10 Priority

While many will be drawn to the premium experience that the Pixel 10 Pro and Pixel 10 Pro XL will deliver, the base Pixel 10 may be the key handset in this family. With an expected move from the Pixel 9’s two camera lenses on the main camera to three, the new Tensor G5 mobile chipset, and the increased use of generative AI, the Pixel 10 is the smartphone most likely to reshape the market with its €899 price tag.

The Pixel 10 Pro Fold’s New Focus

One pricing decision that may come as a disappointment is with the Pixel 10 Pro Fold. It has been previously reported that Google would aggressively price its foldable to focus the foldable market on a general consumer audience. Instead, the Pixel 10 Pro Fold pricing on show here matches the Pro Fold from 2024—matching the other smartphones in the Pixel 10 family.

With Samsung’s increased focus on the consumer experience with the Galaxy Z Fold7 and Z Flip 7, plus Honor’s prioritisation of design and fashion with the Magic V5, perhaps Google is focusing on using the Pixel 10 Pro Fold as an ongoing reference design for this part of the market?

Pixel 10 Pro Launch Dates

Google is widely expected to launch the Pixel 10 family at a “Made By Google” event on Aug. 20, with a retail release the following week.

Now read the latest Pixel 10 Pro, Samsung Galaxy, and Android smartphone headlines in our weekly mobile news digest…