The Essential Plugin attack and how WordPress.com cleaned it up
The Essential Plugin attack backdoored more than 30 trusted plugins after the portfolio changed hands. I walk through how the wpos-analytics module worked, why unserialize() on remote data is so dangerous, and how WordPress.com cleaned up 2,200+ affected sites.