Following the public disclosure of a critical zero-day vulnerability in Webmin last week, the project's maintainers today revealed that the flaw was not actually the result of a coding mistake made by the programmers.

Instead, it was secretly planted by an unknown hacker who successfully managed to inject a backdoor at some point in its build infrastructure—that surprisingly persisted into various releases of Webmin (1.882 through 1.921) and eventually remained hidden for over a year.

The Jmail Breaker attack leverages an old vulnerability in Joomla! along with a newly found flaw in the mail module.

UPDATE

SAN FRANCISCO — A fresh campaign from a known adversary is using a flaw in the popular Joomla! CMS platform to carry out a large-scale phishing and spam operation, according to researchers.

How do you check if a website asking for your credentials is fake or legit to log in?

By checking if the URL is correct?

By checking if the website address is not a homograph?

By checking if the site is using HTTPS?

Or using software or browser extensions that detect phishing domains?

'Leakage ... is visible in all Intel generations starting from first-gen Core CPUs'

Updated Further demonstrating the computational risks of looking into the future, boffins have found another way to abuse speculative execution in Intel CPUs to steal secrets and other data from running applications.