{"id":285,"date":"2026-10-17T11:03:49","date_gmt":"2026-10-17T09:03:49","guid":{"rendered":"https:\/\/helloblog.io\/ro\/rank-math-seo-pro-3-0-123-malware-pachete-oficiale-recuperare\/"},"modified":"2026-10-17T11:03:49","modified_gmt":"2026-10-17T09:03:49","slug":"rank-math-seo-pro-3-0-123-malware-pachete-oficiale-recuperare","status":"publish","type":"post","link":"https:\/\/helloblog.io\/ro\/rank-math-seo-pro-3-0-123-malware-pachete-oficiale-recuperare\/","title":{"rendered":"Rank Math SEO PRO 3.0.123: malware \u00een pachetele oficiale \u0219i pa\u0219ii de recuperare"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Dac\u0103 ai desc\u0103rcat sau ai actualizat Rank Math PRO la versiunea 3.0.123 \u00een intervalul <strong>15 octombrie 2026, 20:02 UTC \u2013 16 octombrie 2026, 07:12 UTC<\/strong>, verific\u0103 ce copie ai instalat \u0219i dac\u0103 ai activat-o. Unele pachete oficiale distribuite \u00een aceste aproximativ 11 ore au con\u021binut malware. Rank Math a retras fi\u0219ierele afectate \u0219i a publicat versiunea curat\u0103 <strong>3.0.124<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nu trata \u00eens\u0103 incidentul ca pe o actualizare obi\u0219nuit\u0103 de securitate. Dac\u0103 ai activat o copie infectat\u0103, actualizarea \u00eenlocuie\u0219te pachetul Rank Math PRO, dar <strong>nu \u0219terge fi\u0219ierele, conturile de administrator sau sarcinile programate pe care malware-ul le-a creat \u00een alte locuri<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ce s-a \u00eent\u00e2mplat<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Atacatorul a introdus cod mali\u021bios \u00een unele pachete oficiale ale pluginului, pe care utilizatorii le-au primit prin desc\u0103rcare sau actualizare. Acesta este un atac asupra lan\u021bului de distribu\u021bie software: problema nu a fost o eroare de programare exploatat\u0103 \u00eentr-o copie legitim\u0103, ci chiar pachetul distribuit. Rank Math nu a publicat mecanismul prin care atacatorul a modificat pachetele; nu exist\u0103 aici o baz\u0103 pentru atribuirea atacului sau pentru estimarea num\u0103rului de victime.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Wordfence Intelligence \u00eenregistreaz\u0103 incidentul drept <strong>CVE-2026-111862<\/strong>, cu scorul <strong>CVSS 9,8 &#8211; critic<\/strong>. CVE identific\u0103 public vulnerabilitatea, iar CVSS exprim\u0103 severitatea tehnic\u0103. \u00cenregistrarea descrie cod mali\u021bios \u00eencorporat care nu necesit\u0103 autentificare \u0219i indic\u0103 identificatorul pluginului <code>seo-by-rank-math-pro<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Malware-ul ruleaz\u0103 c\u00e2nd activezi pluginul infectat, poate p\u0103stra accesul atacatorului \u0219i comunic\u0103 cu domeniul <code>rank1cdn[.]com<\/code>. \u00cen plus, poate recrea fi\u0219iere ascunse de acces la vizitele pe site. Trateaz\u0103 drept poten\u021bial expuse parolele WordPress, creden\u021bialele bazei de date, cheile pentru interfe\u021be de programare &#8211; API &#8211; \u0219i celelalte secrete pe care procesul serverului web le poate citi.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Versiunea nu confirm\u0103 singur\u0103 compromiterea<\/h4>\n\n\n<p class=\"wp-block-paragraph\">Nu toate copiile Rank Math PRO 3.0.123 au con\u021binut malware. Conteaz\u0103 dac\u0103 ai ob\u021binut pachetul \u00een intervalul afectat \u0219i dac\u0103 l-ai activat. Incidentul prive\u0219te extensia PRO; notificarea nu indic\u0103 pluginul gratuit Rank Math drept afectat.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Verific\u0103 \u00een care dintre cele trei situa\u021bii te afli<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Intr\u0103 \u00een panoul de administrare WordPress \u0219i verific\u0103 versiunea Rank Math PRO \u00een pagina <strong>Pluginuri<\/strong>. Coreleaz\u0103 versiunea cu momentul \u00een care ai desc\u0103rcat sau ai primit actualizarea \u0219i cu istoricul activ\u0103rii. \u00cen ora Europei Centrale, intervalul afectat a fost <strong>15 octombrie, 22:02 CEST \u2013 16 octombrie, 09:12 CEST<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">| Situa\u021bie | Ce ai de f\u0103cut |\n| &#8212; | &#8212; |\n| Ai instalat \u0219i activat copia 3.0.123 ob\u021binut\u0103 \u00een intervalul afectat. | Trateaz\u0103 site-ul ca fiind compromis \u0219i urmeaz\u0103 pa\u0219ii de recuperare de mai jos. |\n| Ai instalat copia afectat\u0103, dar nu ai activat-o niciodat\u0103. | \u0218terge fi\u0219ierele pluginului, instaleaz\u0103 versiunea curat\u0103 3.0.124 din contul Rank Math \u0219i ruleaz\u0103 preventiv o scanare de securitate. |\n| Ai desc\u0103rcat copia afectat\u0103, dar nu ai instalat-o \u0219i nu ai activat-o. | Acest incident, luat separat, nu indic\u0103 faptul c\u0103 site-ul t\u0103u a fost compromis. Dac\u0103 nu po\u021bi confirma ce ai instalat sau activat, cere ajutor echipei de asisten\u021b\u0103. |<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rank Math p\u0103streaz\u0103 eviden\u021ba utilizatorilor care au desc\u0103rcat copiile afectate \u0219i \u00eei notific\u0103. Dac\u0103 ai primit o notificare, urmeaz\u0103 pa\u0219ii corespunz\u0103tori situa\u021biei tale <strong>chiar dac\u0103 acum rulezi alt\u0103 versiune<\/strong>. Pentru neclarit\u0103\u021bi, po\u021bi deschide un <a href=\"https:\/\/rankmath.com\/support\/\">tichet de asisten\u021b\u0103<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Comenzi pentru o verificare ini\u021bial\u0103<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Folose\u0219te WP-CLI, interfa\u021ba prin care administrezi WordPress din linia de comand\u0103, pentru a verifica rapid versiunea, c\u00e2teva urme cunoscute \u0219i conturile de administrator. Ruleaz\u0103 comenzile din directorul instal\u0103rii WordPress. Ele ajut\u0103 la investiga\u021bie, dar nu \u00eenlocuiesc pa\u0219ii de cur\u0103\u021bare.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly># Verific\u0103 versiunea instalat\u0103.\nwp plugin get seo-by-rank-math-pro --field=version\n\n# Caut\u0103 op\u021biunile asociate malware-ului.\nwp option get _uf6qdn2hmm\nwp option get t8krdk990phb\nwp option get _np5pvf754c\n\n# Listeaz\u0103 administratorii \u0219i data \u00eenregistr\u0103rii fiec\u0103rui cont.\nwp user list --role=administrator --fields=ID,user_login,user_email,user_registered\n\n# Compar\u0103 fi\u0219ierele WordPress core cu sumele de control oficiale.\nwp core verify-checksums\n\n# Listeaz\u0103 evenimentele programate \u00een WordPress.\nwp cron event list\n\n# Verific\u0103 fi\u0219ierul care imit\u0103 un fi\u0219ier WordPress core.\nls -la wp-includes\/class-wp-cache-util.php\n\n# \u00cenlocuie\u0219te www-data dac\u0103 serverul web ruleaz\u0103 sub alt utilizator.\n# Comanda poate necesita privilegii suplimentare.\ncrontab -l -u www-data | grep ms6v46\n\n# Caut\u0103 cheia cunoscut\u0103 \u00een fi\u0219ierele din wp-content.\ngrep -RIn -- 'xmmqhn' wp-content\/\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\"># Verific\u0103 versiunea instalat\u0103.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> plugin<\/span><span style=\"color:#9ECBFF\"> get<\/span><span style=\"color:#9ECBFF\"> seo-by-rank-math-pro<\/span><span style=\"color:#79B8FF\"> --field=version<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Caut\u0103 op\u021biunile asociate malware-ului.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> option<\/span><span style=\"color:#9ECBFF\"> get<\/span><span style=\"color:#9ECBFF\"> _uf6qdn2hmm<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> option<\/span><span style=\"color:#9ECBFF\"> get<\/span><span style=\"color:#9ECBFF\"> t8krdk990phb<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> option<\/span><span style=\"color:#9ECBFF\"> get<\/span><span style=\"color:#9ECBFF\"> _np5pvf754c<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Listeaz\u0103 administratorii \u0219i data \u00eenregistr\u0103rii fiec\u0103rui cont.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> user<\/span><span style=\"color:#9ECBFF\"> list<\/span><span style=\"color:#79B8FF\"> --role=administrator<\/span><span style=\"color:#79B8FF\"> --fields=ID,user_login,user_email,user_registered<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Compar\u0103 fi\u0219ierele WordPress core cu sumele de control oficiale.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> core<\/span><span style=\"color:#9ECBFF\"> verify-checksums<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Listeaz\u0103 evenimentele programate \u00een WordPress.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> cron<\/span><span style=\"color:#9ECBFF\"> event<\/span><span style=\"color:#9ECBFF\"> list<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Verific\u0103 fi\u0219ierul care imit\u0103 un fi\u0219ier WordPress core.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">ls<\/span><span style=\"color:#79B8FF\"> -la<\/span><span style=\"color:#9ECBFF\"> wp-includes\/class-wp-cache-util.php<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># \u00cenlocuie\u0219te www-data dac\u0103 serverul web ruleaz\u0103 sub alt utilizator.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Comanda poate necesita privilegii suplimentare.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">crontab<\/span><span style=\"color:#79B8FF\"> -l<\/span><span style=\"color:#79B8FF\"> -u<\/span><span style=\"color:#9ECBFF\"> www-data<\/span><span style=\"color:#F97583\"> |<\/span><span style=\"color:#B392F0\"> grep<\/span><span style=\"color:#9ECBFF\"> ms6v46<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Caut\u0103 cheia cunoscut\u0103 \u00een fi\u0219ierele din wp-content.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">grep<\/span><span style=\"color:#79B8FF\"> -RIn<\/span><span style=\"color:#79B8FF\"> --<\/span><span style=\"color:#9ECBFF\"> 'xmmqhn'<\/span><span style=\"color:#9ECBFF\"> wp-content\/<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<div class=\"wp-block-group callout callout-info is-style-info is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Absen\u021ba unui indicator nu este un certificat de cur\u0103\u021benie<\/h4>\n\n\n<p class=\"wp-block-paragraph\">Verific\u0103 toate zonele descrise mai jos. Malware-ul poate l\u0103sa acces persistent \u00een afara folderului Rank Math PRO \u0219i chiar \u00een afara directorului site-ului.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Varianta recomandat\u0103: revino la o copie de siguran\u021b\u0103 curat\u0103<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 ai activat copia infectat\u0103, recupereaz\u0103 fi\u0219ierele site-ului \u0219i baza de date dintr-o copie de siguran\u021b\u0103 creat\u0103 <strong>\u00eenainte de 15 octombrie 2026, 20:02 UTC<\/strong>. Acela\u0219i prag \u00eenseamn\u0103 15 octombrie, 22:02 CEST sau 16:02 EDT, respectiv 16 octombrie, 01:32 IST. Alege o copie despre care po\u021bi confirma c\u0103 este curat\u0103.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>Restaureaz\u0103 at\u00e2t fi\u0219ierele site-ului, c\u00e2t \u0219i baza de date<\/strong> din copia creat\u0103 \u00eenaintea intervalului afectat.<\/li>\n\n\n<li><strong>Ruleaz\u0103 o scanare de securitate<\/strong> cu un instrument reputabil, precum <a href=\"https:\/\/wordpress.org\/plugins\/wordfence\/\">Wordfence<\/a> sau <a href=\"https:\/\/wordpress.org\/plugins\/sucuri-scanner\/\">Sucuri<\/a>.<\/li>\n\n\n<li><strong>Schimb\u0103 toate parolele \u0219i creden\u021bialele poten\u021bial expuse.<\/strong> Urmeaz\u0103 integral lista din sec\u021biunea despre creden\u021biale: revenirea la o copie mai veche nu face secretele deja expuse din nou sigure.<\/li>\n\n\n<li><strong>Instaleaz\u0103 Rank Math PRO 3.0.124<\/strong>, desc\u0103rcat din contul t\u0103u Rank Math, dup\u0103 ce ai restaurat site-ul \u0219i ai parcurs pa\u0219ii anteriori.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 nu \u0219tii cum s\u0103 restaurezi copia de siguran\u021b\u0103, cere ajutor furnizorului de hosting. Verific\u0103 apoi \u0219i mediul serverului, nu doar directorul WordPress, pentru c\u0103 atacatorul ar fi putut modifica zone pe care copia site-ului nu le acoper\u0103.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">F\u0103r\u0103 o copie curat\u0103: cur\u0103\u021b\u0103 manual, \u00een ordinea corect\u0103<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Opre\u0219te mai \u00eent\u00e2i mecanismul prin care malware-ul \u00ee\u0219i reface accesul ascuns \u0219i abia apoi \u0219terge celelalte urme. O vizit\u0103 pe site poate declan\u0219a recrearea fi\u0219ierelor mali\u021bioase, a\u0219a c\u0103 \u0219tergerea lor izolat\u0103 nu rezolv\u0103 neap\u0103rat incidentul. Dac\u0103 nu lucrezi \u00een siguran\u021b\u0103 cu fi\u0219ierele, baza de date \u0219i set\u0103rile serverului, las\u0103 ace\u0219ti pa\u0219i furnizorului de hosting sau unui specialist \u00een securitate.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Opre\u0219te mecanismul care recreeaz\u0103 malware-ul<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Finalizeaz\u0103 toate ac\u021biunile de mai jos \u00eenainte s\u0103 cau\u021bi \u0219i s\u0103 elimini celelalte modific\u0103ri. <strong>Simpla dezactivare a pluginului nu este suficient\u0103.<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>\u0218terge \u00eentregul folder al pluginului Rank Math PRO.<\/strong> Folose\u0219te managerul de fi\u0219iere al hostingului sau accesul prin protocolul de transfer de fi\u0219iere FTP. Instruc\u021biunile incidentului indic\u0103 folderul <code>rank-math-pro<\/code>; identific\u0103 directorul instal\u0103rii PRO \u00eenainte s\u0103 \u00eel \u0219tergi.<\/li>\n\n\n<li><strong>\u0218terge intr\u0103rile mali\u021bioase din baza de date.<\/strong> \u00cen phpMyAdmin sau \u00eentr-un instrument similar, deschide tabelul <code>wp_options<\/code> \u0219i caut\u0103 valorile <code>option_name<\/code> <code>_uf6qdn2hmm<\/code>, <code>t8krdk990phb<\/code> \u0219i <code>_np5pvf754c<\/code>. \u0218terge intr\u0103rile corespunz\u0103toare pe care le g\u0103se\u0219ti. Dac\u0103 instalarea folose\u0219te alt prefix pentru tabele, verific\u0103 tabelul de op\u021biuni cu acel prefix.<\/li>\n\n\n<li><strong>Blocheaz\u0103 conexiunile de ie\u0219ire c\u0103tre <code>rank1cdn.com<\/code>, dac\u0103 po\u021bi.<\/strong> Aplic\u0103 regula prin firewall sau cere furnizorului de hosting s\u0103 o aplice.<\/li>\n\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">2. Caut\u0103 \u0219i elimin\u0103 celelalte modific\u0103ri mali\u021bioase<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Atacatorul poate p\u0103stra accesul prin fi\u0219iere suplimentare, conturi sau modific\u0103ri la nivelul serverului. Parcurge fiecare zon\u0103 din lista urm\u0103toare; nu te opri dup\u0103 primul fi\u0219ier suspect.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Fi\u0219iere ascunse care p\u0103streaz\u0103 accesul<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Caut\u0103 fi\u0219iere PHP suspecte care func\u021bioneaz\u0103 ca backdoor, adic\u0103 \u00eei permit atacatorului s\u0103 reintre \u00een sistem. Verific\u0103 separat urm\u0103toarele directoare:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><code>wp-content\/mu-plugins\/<\/code>, unde WordPress \u00eencarc\u0103 automat pluginurile obligatorii.<\/li>\n\n\n<li>Directoarele celorlalte pluginuri.<\/li>\n\n\n<li>Directoarele <code>inc\/<\/code>, <code>includes\/<\/code> \u0219i <code>lib\/<\/code> ale temelor care nu fac parte din temele implicite WordPress.<\/li>\n\n\n<li>Directorul <code>includes\/<\/code> al pluginului Rank Math.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Caut\u0103 cod care combin\u0103 <code>base64_decode<\/code> cu bucle XOR, opera\u021bii care pot masca instruc\u021biunile mali\u021bioase, precum \u0219i cheia <code>xmmqhn<\/code>. Investigheaz\u0103 \u0219i apari\u021biile <code>proc_open<\/code> sau codul care folose\u0219te socketuri PHP-FPM, canalele de comunicare cu managerul proceselor PHP. Un plugin de securitate sau furnizorul de hosting te poate ajuta s\u0103 cau\u021bi ace\u0219ti indicatori \u0219i s\u0103 elimini fi\u0219ierele mali\u021bioase.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Conturi de administrator necunoscute<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Examineaz\u0103 toate conturile cu privilegii de administrator. Acord\u0103 aten\u021bie numelor care \u00eencep cu <code>wpsupport_<\/code> \u0219i continu\u0103 cu caractere aleatorii, precum \u0219i adreselor de e-mail cu domeniul <code>@wp-mail[.]net<\/code>. Elimin\u0103 conturile pe care le confirmi drept mali\u021bioase sau neautorizate.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>wp user list --role=administrator\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> user<\/span><span style=\"color:#9ECBFF\"> list<\/span><span style=\"color:#79B8FF\"> --role=administrator<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h4 class=\"wp-block-heading\">Un fi\u0219ier fals din WordPress core<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Verific\u0103 dac\u0103 exist\u0103 <code>wp-includes\/class-wp-cache-util.php<\/code>. <strong>Acesta nu este un fi\u0219ier legitim din WordPress core.<\/strong> Dac\u0103 \u00eel g\u0103se\u0219ti, \u0219terge-l \u0219i verific\u0103 sumele de control, adic\u0103 valorile prin care compari integritatea fi\u0219ierelor cu exemplarele oficiale.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>wp core verify-checksums\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> core<\/span><span style=\"color:#9ECBFF\"> verify-checksums<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Reinstaleaz\u0103 fi\u0219ierele WordPress core dintr-o surs\u0103 oficial\u0103, pentru a \u00eenlocui \u0219i eventualele alte fi\u0219iere modificate. Nu limita interven\u021bia la fi\u0219ierul fals pe care l-ai identificat.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Reguli \u00een .htaccess \u0219i fi\u0219iere .cache<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Examineaz\u0103 fi\u0219ierul <code>.htaccess<\/code> din directorul principal al site-ului \u0219i fi\u0219ierele cu acela\u0219i nume din subdirectoare. Caut\u0103 reguli care permit executarea fi\u0219ierelor <code>.cache<\/code> drept cod PHP. Caut\u0103 apoi pe server fi\u0219iere <code>.cache<\/code> care con\u021bin PHP \u0219i investigheaz\u0103 rezultatele suspecte.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Sarcini programate \u00een sistem \u0219i \u00een WordPress<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Verific\u0103 crontabul utilizatorului sub care ruleaz\u0103 serverul web, adic\u0103 lista sarcinilor pe care sistemul le execut\u0103 periodic. Caut\u0103 \u00een special intr\u0103ri marcate cu <code>#ms6v46<\/code>. Separat, examineaz\u0103 evenimentele programate \u00een WordPress \u0219i elimin\u0103 sarcinile pe care le confirmi drept mali\u021bioase.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly># Adapteaz\u0103 utilizatorul la configura\u021bia serverului.\ncrontab -l -u www-data | grep ms6v46\n\n# Verific\u0103 separat evenimentele programate \u00een WordPress.\nwp cron event list\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\"># Adapteaz\u0103 utilizatorul la configura\u021bia serverului.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">crontab<\/span><span style=\"color:#79B8FF\"> -l<\/span><span style=\"color:#79B8FF\"> -u<\/span><span style=\"color:#9ECBFF\"> www-data<\/span><span style=\"color:#F97583\"> |<\/span><span style=\"color:#B392F0\"> grep<\/span><span style=\"color:#9ECBFF\"> ms6v46<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Verific\u0103 separat evenimentele programate \u00een WordPress.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> cron<\/span><span style=\"color:#9ECBFF\"> event<\/span><span style=\"color:#9ECBFF\"> list<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h4 class=\"wp-block-heading\">Alte pluginuri, teme \u0219i fi\u0219iere \u00eenc\u0103rcate<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Reinstaleaz\u0103 pluginurile \u0219i temele din sursele oficiale. Compar\u0103 fi\u0219ierele cu exemplare curate acolo unde po\u021bi.<\/li>\n\n\n<li>Verific\u0103 directorul <code>uploads\/<\/code> pentru fi\u0219iere PHP; \u00een general, acestea nu ar trebui s\u0103 existe acolo.<\/li>\n\n\n<li>Investigheaz\u0103 fi\u0219ierele nea\u0219teptate sau modificate \u00eenainte s\u0103 le \u0219tergi.<\/li>\n\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Mediul serverului, dincolo de WordPress<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Verific\u0103 \u0219i locurile din afara instal\u0103rii WordPress \u00een care atacatorul ar fi putut p\u0103stra accesul. Dac\u0103 folose\u0219ti hosting partajat \u0219i nu ai permisiunile necesare, cere furnizorului s\u0103 examineze aceste zone.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Fi\u0219ierele <code>authorized_keys<\/code> folosite pentru accesul SSH, protocolul de acces securizat la server.<\/li>\n\n\n<li>Crontaburile celorlal\u021bi utilizatori ai sistemului.<\/li>\n\n\n<li>Procesele care ruleaz\u0103 pe server.<\/li>\n\n\n<li>Directoarele din afara site-ului \u00een care utilizatorul serverului web poate scrie.<\/li>\n\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3. Schimb\u0103 toate parolele \u0219i creden\u021bialele<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u00cenlocuie\u0219te secretele la care site-ul compromis putea avea acces, chiar dac\u0103 nu ai o dovad\u0103 c\u0103 atacatorul le-a extras. <strong>Acest pas este obligatoriu \u0219i dup\u0103 recuperarea dintr-o copie de siguran\u021b\u0103.<\/strong> Alege valori noi \u0219i sigure, apoi actualizeaz\u0103 configura\u021bia site-ului \u0219i serviciile conectate oriunde folosesc creden\u021bialele vechi.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Toate parolele relevante:<\/strong> schimb\u0103 parolele conturilor WordPress \u0219i celelalte parole accesibile site-ului compromis.<\/li>\n\n\n<li><strong>Creden\u021bialele bazei de date:<\/strong> schimb\u0103 utilizatorul \u0219i parola bazei de date, apoi actualizeaz\u0103 valorile din <code>wp-config.php<\/code>.<\/li>\n\n\n<li><strong>Cheile de securitate \u0219i valorile salt din WordPress:<\/strong> regenereaz\u0103 valorile din <code>wp-config.php<\/code> pe care WordPress le folose\u0219te pentru protejarea autentific\u0103rii \u0219i a sesiunilor.<\/li>\n\n\n<li><strong>Cheile API \u0219i creden\u021bialele serviciilor:<\/strong> \u00eenlocuie\u0219te cheile procesatorilor de pl\u0103\u021bi, creden\u021bialele SMTP pentru trimiterea e-mailurilor, celelalte chei API \u0219i secretele din set\u0103rile site-ului sau din fi\u0219ierele de configurare.<\/li>\n\n\n<li><strong>Accesul la hosting \u0219i server:<\/strong> schimb\u0103 parolele sau creden\u021bialele panoului de hosting, ale accesului FTP, SFTP &#8211; transfer securizat de fi\u0219iere &#8211; \u0219i SSH. Verific\u0103 \u0219i secretele din variabilele de mediu.<\/li>\n\n\n<li><strong>Autentificarea cu doi factori:<\/strong> verific\u0103 set\u0103rile conturilor de administrator \u0219i reseteaz\u0103-le acolo unde este necesar.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 nu po\u021bi stabili ce creden\u021biale putea citi site-ul, cere furnizorului de hosting sau specialistului \u00een securitate s\u0103 le inventarieze \u00eempreun\u0103 cu tine. Nu te limita la parolele utilizatorilor WordPress.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Verific\u0103 rezultatul cur\u0103\u021b\u0103rii<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Dup\u0103 ce ai eliminat modific\u0103rile \u0219i ai schimbat creden\u021bialele, verific\u0103 din nou fi\u0219ierele \u0219i comportamentul site-ului. Parcurge toate cele cinci controale:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Ruleaz\u0103 o scanare de securitate cu Wordfence, Sucuri sau un alt instrument reputabil.<\/li>\n\n\n<li>Verific\u0103 fi\u0219ierele WordPress core cu <code>wp core verify-checksums<\/code>.<\/li>\n\n\n<li>Verific\u0103 pluginurile instalate cu <code>wp plugin verify-checksums --all<\/code>. Nu toate pluginurile, \u00een special cele premium, au sume de control disponibile. \u00cen aceste cazuri, compar\u0103 fi\u0219ierele cu o copie curat\u0103 ob\u021binut\u0103 din sursa oficial\u0103.<\/li>\n\n\n<li>Monitorizeaz\u0103 conexiunile de ie\u0219ire \u0219i urm\u0103re\u0219te activitatea suspect\u0103 \u00een zilele urm\u0103toare.<\/li>\n\n\n<li>Verific\u0103 dac\u0103 fi\u0219ierele pe care le-ai \u0219ters reapar.<\/li>\n\n<\/ol>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>wp core verify-checksums\nwp plugin verify-checksums --all\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> core<\/span><span style=\"color:#9ECBFF\"> verify-checksums<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> plugin<\/span><span style=\"color:#9ECBFF\"> verify-checksums<\/span><span style=\"color:#79B8FF\"> --all<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Dac\u0103 fi\u0219ierele reapar, continu\u0103 investiga\u021bia<\/h4>\n\n\n<p class=\"wp-block-paragraph\">Reapari\u021bia fi\u0219ierelor suspecte sau activitatea neobi\u0219nuit\u0103 poate indica o cur\u0103\u021bare incomplet\u0103. Reia pasul 2, \u00een care verifici celelalte modific\u0103ri mali\u021bioase, \u0219i cere furnizorului de hosting sau unui specialist s\u0103 investigheze mai departe.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Indicatorii de compromitere pe care s\u0103 \u00eei cau\u021bi<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Folose\u0219te urm\u0103torii indicatori de compromitere, numi\u021bi \u0219i IOC, pentru c\u0103ut\u0103ri \u00een fi\u0219iere, baze de date \u0219i jurnale. Ei grupeaz\u0103 urmele cunoscute ale incidentului, dar nu \u00eenlocuiesc verificarea \u00eentregului mediu.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Domeniu de comunicare:<\/strong> <code>rank1cdn[.]com<\/code>; pentru regula de blocare, domeniul este <code>rank1cdn.com<\/code>.<\/li>\n\n\n<li><strong>Op\u021biuni \u00een baza de date:<\/strong> <code>_uf6qdn2hmm<\/code>, <code>t8krdk990phb<\/code>, <code>_np5pvf754c<\/code>.<\/li>\n\n\n<li><strong>Cheie \u00een codul suspect:<\/strong> <code>xmmqhn<\/code>.<\/li>\n\n\n<li><strong>Tipare de cod:<\/strong> <code>base64_decode<\/code> \u00eempreun\u0103 cu bucle XOR, <code>proc_open<\/code> sau cod pentru socketuri PHP-FPM.<\/li>\n\n\n<li><strong>Nume de conturi suspecte:<\/strong> <code>wpsupport_<\/code> urmat de caractere aleatorii.<\/li>\n\n\n<li><strong>Domeniu al adreselor de e-mail suspecte:<\/strong> <code>@wp-mail[.]net<\/code>.<\/li>\n\n\n<li><strong>Fi\u0219ier fals din WordPress core:<\/strong> <code>wp-includes\/class-wp-cache-util.php<\/code>.<\/li>\n\n\n<li><strong>Marcaj \u00een sarcinile cron ale sistemului:<\/strong> <code>#ms6v46<\/code>.<\/li>\n\n\n<li><strong>Alte urme de investigat:<\/strong> fi\u0219iere <code>.cache<\/code> cu PHP \u0219i reguli <code>.htaccess<\/code> care permit executarea lor.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Instaleaz\u0103 copia curat\u0103 f\u0103r\u0103 s\u0103 urmezi linkuri din e-mailuri<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Dup\u0103 ce ai parcurs recuperarea potrivit\u0103 situa\u021biei tale, instaleaz\u0103 <strong>Rank Math PRO 3.0.124<\/strong>. Introdu direct <code>rankmath.com<\/code> \u00een browser, autentific\u0103-te \u00een cont \u0219i descarc\u0103 pluginul din sec\u021biunea de desc\u0103rc\u0103ri. Dac\u0103 nu te po\u021bi autentifica, poate fi necesar s\u0103 resetezi parola contului.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rank Math precizeaz\u0103 c\u0103 nu trimite prin e-mail linkuri pentru autentificare sau desc\u0103rcare. Trateaz\u0103 drept suspecte mesajele nesolicitate care \u00ee\u021bi cer s\u0103 urmezi un link pentru resetarea parolei sau pentru desc\u0103rcarea pluginului. Porne\u0219te orice astfel de opera\u021biune din site-ul pe care \u00eel deschizi direct.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Evit\u0103 copiile de pe site-uri neoficiale sau de redistribuire GPL, licen\u021ba public\u0103 general\u0103: acestea pot continua s\u0103 ofere versiunea 3.0.123. Descarc\u0103 pachetul din contul furnizorului. Dac\u0103 ai nevoie de ajutor, scrie la <code>support@rankmath.com<\/code> sau deschide un <a href=\"https:\/\/rankmath.com\/support\/\">tichet de asisten\u021b\u0103<\/a> \u0219i include versiunea PRO, situa\u021bia site-ului \u0219i pa\u0219ii de recuperare pe care i-ai parcurs deja.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ce s\u0103 schimbi \u00een administrarea site-urilor<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Include \u0219i furnizorii comerciali de \u00eencredere \u00een scenariile tale de r\u0103spuns la incidente: un pachet oficial poate deveni chiar calea de intrare. Pentru site-urile pe care le administrezi, verific\u0103 acum dac\u0103 po\u021bi reveni la o copie curat\u0103 \u0219i dac\u0103 po\u021bi detecta schimb\u0103rile care apar dup\u0103 o actualizare.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Reevalueaz\u0103 actualiz\u0103rile automate ale pluginurilor premium.<\/strong> Ele ajut\u0103 la aplicarea rapid\u0103 a remediilor, dar pot distribui automat \u0219i un pachet compromis. Stabile\u0219te cum verifici site-ul dup\u0103 actualizare.<\/li>\n\n\n<li><strong>P\u0103streaz\u0103 copii de siguran\u021b\u0103 \u00een afara serverului site-ului \u0219i re\u021bine mai multe versiuni istorice.<\/strong> Ai nevoie de o copie anterioar\u0103 incidentului, nu doar de ultima copie disponibil\u0103.<\/li>\n\n\n<li><strong>Monitorizeaz\u0103 \u0219i restric\u021bioneaz\u0103 conexiunile de ie\u0219ire ale serverului web.<\/strong> Include aceste conexiuni \u00een verific\u0103rile curente \u0219i \u00een investiga\u021biile de securitate.<\/li>\n\n\n<li><strong>Verific\u0103 integritatea fi\u0219ierelor.<\/strong> Folose\u0219te sumele de control acolo unde exist\u0103 \u0219i copii oficiale curate pentru pluginurile care nu ofer\u0103 aceast\u0103 verificare.<\/li>\n\n\n<li><strong>P\u0103streaz\u0103 o procedur\u0103 pentru schimbarea creden\u021bialelor \u0219i pentru accesul la furnizorul de hosting.<\/strong> \u00centr-un incident, trebuie s\u0103 po\u021bi interveni \u0219i \u00een afara WordPress.<\/li>\n\n\n<li><strong>Ob\u021bine pluginurile din contul furnizorului \u0219i verific\u0103 mesajele primite.<\/strong> Nu transforma un e-mail care pretinde c\u0103 ofer\u0103 o solu\u021bie de securitate \u00eentr-un al doilea punct de intrare.<\/li>\n\n<\/ul>\n\n\n<div class=\"references-section\">\n                <h2>Referin\u021be \/ Surse<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/rankmath.com\/kb\/pro-3-0-123-security-incident\/\" target=\"_blank\" rel=\"noopener noreferrer\">Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/10\/rank-math-seo-pro-3-0-123-malware\/\" target=\"_blank\" rel=\"noopener noreferrer\">Wordfence PSA: Rank Math SEO PRO 3.0.123 malware<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/81cd7a2c-ad0c-4dbc-b5dc-07ec866d5c1f\" target=\"_blank\" rel=\"noopener noreferrer\">Rank Math SEO PRO 3.0.123 &#8211; Unauthenticated Embedded Malicious Code<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Unele pachete oficiale Rank Math PRO 3.0.123 au con\u021binut malware. Verific\u0103 dac\u0103 ai primit o copie afectat\u0103 \u0219i de ce simpla actualizare la 3.0.124 nu cur\u0103\u021b\u0103 un site compromis.<\/p>\n","protected":false},"author":31,"featured_media":284,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[54,149,150,10,7],"class_list":["post-285","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-securitate","tag-malware","tag-rank-math","tag-securitatea-pluginurilor","tag-wordpress","tag-wp-cli"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/posts\/285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/users\/31"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/comments?post=285"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/posts\/285\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/media\/284"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/media?parent=285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/categories?post=285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/tags?post=285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}