AI Weekly Malaysia

A supply chain attack on WordPress plugin vendor BdThemes compromised at least seven Elementor add-on plugins, including Element Pack (100,000+ active installs), by poisoning a remote JSON data stream rather than modifying any source code in the WordPress.org repository. The XSS flaw in the 'Biggopti' promotional banner component, which fetches JSON from a DigitalOcean Spaces bucket via the Sigmative API, allowed attackers to inject scripts via the 'display_id' parameter and potentially create rogue admin accounts. WordPress.org disabled all affected plugins on August 7-8, 2026 pending full review.

Why: If you run WordPress sites with any BdThemes Elementor add-ons (especially Element Pack, Live Copy Paste, or Ultimate Store Kit), check immediately whether these plugins are installed and assume admin-level compromise is possible even though no plugin files were altered. For builders shipping plugins or SaaS that fetch remote JSON for dashboards or banners, this is a concrete lesson: client-side escaping of remotely fetched JSON fields like 'display_id' is mandatory, and a compromised CDN or API endpoint can escalate to full admin takeover without touching your codebase.

A Show HN project by Alen (github: alenvelocity) renders all 43,252,003,274,489,856,000 Rubik's Cube permutations in a scrollable 2D/3D viewer, with presets like Superflip and Checkerboard and scale markers at 1.1×10¹⁹ through 4.3×10¹⁹.

Why: Not actionable for shipping work, but a neat example of compressing an astronomically large state space into a browsable UI — useful as inspiration for how to visualize and navigate huge combinatorial datasets in a web app.