On April 7, 2026, attackers hijacked the update delivery infrastructure for Smart Slider 3 Pro and pushed a malicious build (v3.5.1.35) to over 900,000 WordPress sites and an unknown number of Joomla installations. The trojanized update installs a backdoor that gives attackers unauthenticated remote access, the ability to create hidden administrator accounts, and persistence mechanisms that survive password resets and standard remediation. Any site that auto-updated during the compromise window must be treated as fully compromised until forensically cleared.