BreachesRank Math PRO Updates Were Poisoned for 11 Hours. Any Site That Pulled One Is Owned.
A paid WordPress SEO plugin trusted on millions of sites shipped malicious updates for part of October 15 and 16. The backdoor rebuilds itself if you delete it.