OptinMonster supply chain attack hits 1.2 million sites

An active supply-chain attack targeted over 1.2 million WordPress sites using OptinMonster, TrustPulse, and PushEngage plugins operated by Awesome Motive. Attackers injected malicious JavaScript into legitimate files served through Awesome Motive's CDN endpoints. The malware activates when a logged-in administrator accesses the site, creating backdoor admin accounts (developer_api1 and randomized dev_xxxxxx accounts) and installing a self-hiding PHP plugin. The backdoor provides unauthenticated code execution through a web shell and eval endpoint. Stolen credentials are exfiltrated to tidio.cc, a lookalike domain mimicking the legitimate tidio.com. The breach likely originated from compromised Awesome Motive servers or their BunnyNet CDN account. The campaign began in late April 2026 and remained active through mid-June, affecting OptinMonster (over 1 million installations), TrustPulse, and PushEngage users.

Pulse ID: 6a2ec0e674b2d14b332499fa
Pulse Link: https://otx.alienvault.com/pulse/6a2ec0e674b2d14b332499fa
Pulse Author: AlienVault
Created: 2026-06-14 14:55:34

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #CDN #CyberSecurity #ELF #Endpoint #InfoSec #Java #JavaScript #Malware #Mimic #OTX #OpenThreatExchange #PHP #RAT #RDP #Rust #SupplyChain #Word #Wordpress #bot #AlienVault

Iroh 1.0 - Dial Keys, not IPs https://lobste.rs/s/cslljn #distributed #rust
https://www.iroh.computer/blog/v1

Comparison and Benchmarking of Rust Decimal Crates https://lobste.rs/s/odh8si #performance #rust
https://wubingzheng.github.io/en/Decimal-Crates-Comparison.html

Diplomat: Multi-language FFI for Rust Libraries https://lobste.rs/s/mgbtd6 #rust
http://manishearth.github.io/blog/2026/06/14/diplomat-multi-language-ffi-for-rust-libraries/

zinnia: a modular 64-bit Unix-like kernel written in Rust https://lobste.rs/s/0ichrt #osdev #programming #rust
https://zinnia-os.org/

FFI in Miri at 8000 segfaults per second https://lobste.rs/s/daehjf #video #compilers #rust
https://youtu.be/9X-ngiKo_Y0

repo-slopscore: Detecting AI/LLM contributions in git repositories via commit history analysis https://lobste.rs/s/7s8fwa #release #rust #vcs
https://slopscan.ava.pet/

There Is Life Before Main in Rust https://lobste.rs/s/rs1t8s #rust
https://grack.com/blog/2026/06/11/life-before-main/

merman: Mermaid.js, but headless, in Rust https://lobste.rs/s/qchywn #graphics #rust
https://github.com/Latias94/merman

hax: A Rust verification tool https://lobste.rs/s/rdbc5p #formalmethods #rust
https://github.com/cryspen/hax

Bootstrapping Rust Considered Harmful https://lobste.rs/s/pjpqxb #rant #rust
https://www.ntecs.de/blog/2026-02-01-bootstrapping-rust-considered-harmful

Elixir for a Bluesky DataPlane: the choice we didn't expect https://lobste.rs/s/2ljllm #elixir #rust
https://bitcrowd.dev/why-elixir-bluesky-dataplane

Mergeable Containers: Fixing Concurrent Child Creation https://lobste.rs/s/poqzfp #rust
https://loro.dev/blog/mergeable-containers

A line-by-line translation of the OCaml runtime from C to Rust https://lobste.rs/s/k85k6w #c #ml #rust #vibecoding
https://discuss.ocaml.org/t/a-line-by-line-translation-of-the-ocaml-runtime-from-c-to-rust/18247

The Open Source Flight Sim Manifesto https://lobste.rs/s/m8q1qy #show #games #rust
https://viccuad.me/blog/open-source-flight-sim-manifesto

Only Bounds https://lobste.rs/s/srq2wf #plt #rust
https://smallcultfollowing.com/babysteps/blog/2026/06/09/only-bounds/

Fewer False Alarms, Better Coding Flow in RustRover 2026.2
#RustLang #Rust #Rustrover #Falsepositives

https://blog.jetbrains.com/rust/2026/06/09/fewer-false-positives-rustrover/

Abbaye is a Static Site Generator (SSG) for your software releases, for those of us who can't or won't use a full-featured software forge.

Phew, this version has been in the works for a while, and I'm glad to finally release it.

The big highlight of this release is a brand new repository browser that allows you to look at the code of what you would (maybe) download. That's something that was missing compared to most other software release browsers.

You can now browse:

• The availables refs (branches, tags, etc.) of the repository;
• The git history of a given ref;
• Individual commits (with collapsible diffs !);
• The code of a given ref.

Note: The code browser is only generated for branch "tips" (i.e. the latest commit on the branch) and for tags (i.e. the latest commit on the tag).

All of this still as html files without any javascript.

And with the addition of the updater in the last release, all of this is a simple abbaye self-update away!

Here's Abbaye's 0.7.0 page, as built with Abbaye itself: https://vit.am/~ololduck/abbaye/0.7.0/

#Rust #SmallWeb #Rustlang #SSG

Alt...

A screenshot showing the main repository log page showing the commit history for Abbaye

Alt...

Detailed view (with diff!) of the release commit for abbaye v0.7.0

Alt...

"refs" view detailing the branches/tags of the repository

Alt...

Viewing a file (with syntax highlighting) in the integrated file browser

This Month in Redox - May 2026 - Redox - Your Next(Gen) OS https://lobste.rs/s/6ixkjy #osdev #rust
https://www.redox-os.org/news/this-month-260531/

How Other Link Checkers Do Recursion https://lobste.rs/s/scnbr6 #distributed #rust #web
https://endler.dev/2026/how-other-link-checkers-recurse/

Today I'm releasing niri v25.11 with long-awaited config includes, Alt-Tab, true maximize, custom modes, and a bunch of other improvements! Enjoy the release notes :)

https://github.com/YaLTeR/niri/releases/tag/v25.11

#niri #smithay #wayland #rust

After five months of (on and off) development, I'm glad to announce niri v26.04! It comes packed with features:

- window blur, of course, in all its variations
- mouse cursor in window screencasts
- screencast IPC
- optional includes
- IME users can finally rename files in nautilus
- Eee PC users can finally take screenshots

Enjoy the release notes: https://github.com/niri-wm/niri/releases/tag/v26.04

#niri #wayland #rust

Alt...

Screenshot showing blurred background behind a DankMaterialShell pop-out, Alacritty, and Nautilus sidebar.

How Josh helps Rust manage code across multiple repositories via @fanf https://lobste.rs/s/1egwny #rust #vcs
https://blog.rust-lang.org/inside-rust/2026/06/04/how-josh-helps-rust-manage-code-across-multiple-repositories/

Symbolica 2.0: programmable symbols for Python and Rust https://lobste.rs/s/zpjc05 #python #rust
https://symbolica.io/posts/symbolica_2_0_release/

A faster bump allocator for rust https://lobste.rs/s/vta6wp #performance #rust
https://owen.cafe/posts/stumpalo/

Abbaye is a Static Site Generator (SSG) for your software releases, for those of us who can't or won't use a full-featured software forge.

Big usability features in this release! We got:

• parallel builder execution with some nice progress reporting (And if you use the cargo builder, building different targets _also_ is in parallel!);
• A self-update command to update abbaye to the latest version, based on Abbaye's own rss feed;
• Automatic JSON schema generation for abbaye.toml, so you can get autocompletion and type checking for your configuration;
• A markdown builder/renderer for your documentation needs.

#SmallWeb #Rust #Rustlang, #SSG

Alt...

A gif of Abbaye building its release website

Building an AsyncIO executor for the 3DS (pt 2!) https://lobste.rs/s/udax0k #rust
https://blog.cat-girl.gay/3ds-async-part-two/

Revealing the frontier with stacks and queues https://lobste.rs/s/aw5hgu #performance #rust
https://dystroy.org/blog/stack-and-queues/

RustWeek 2026: What We Learned, Who We Met, and What’s Next for Rust
#RustLang #Community #Rustrover #Conference #Event #Rust #Rustide

https://blog.jetbrains.com/rust/2026/06/03/rustrover-at-rustweek-2026/

iddqd, or the hardest kind of unsafe Rust by @rain https://lobste.rs/s/6eyhii #rust
https://oxide.computer/blog/iddqd-unsafe

Memory safety is a matter of life and death https://lobste.rs/s/67tqpz #rust #security
https://joshlf.com/posts/memory-safety-life-and-death/

A Structure-Aware Fuzzing Experiment https://lobste.rs/s/xnbyio #rust #testing
http://fitzgeraldnick.com/2026/06/01/structure-aware-fuzzing-experiment.html

rustc_codegen_jvm: Rust compiler backend to emit JVM bytecode https://lobste.rs/s/lcldxn #java #rust
https://github.com/IntegralPilot/rustc_codegen_jvm

For the past few streams, we've been going pretty high level, especially with the aid of LLMs. Not this time! On Friday at 4pm UTC (https://everytimezone.com/s/2ac07a7b), we're going all the way down to "what bits go where", with honest hand-written #Rust code. Specifically, we're going to write an audio generator that produces WAV files with white, pink, and brown noise. Hopefully I won't blow any speakers (yours or mine), but come find out!

https://youtube.com/live/BKHE7stqhoI?feature=share

Recording of yesterday's stream implementing a WAV noise file generator in #rust is now up on YouTube! We managed to get white, pink, brownian, blue, violet, and grey (psychoacoustic!) noise all implemented, so I'll count that as a success 🔊

https://youtu.be/zOTE4BN59u4

What we'll get out of it:
- support for type-checking lints (#1 top user request)
- fix the remaining classes of false-positives (#2 top user request)
- Rust itself can use cargo-semver-checks to prevent accidental breakage in the standard library (!!)
- a "SemVer crater" ability:
https://predr.ag/blog/cargo-semver-checks-2025-year-in-review/#the-path-forward-for-2026-and-beyond

#rust #rustlang #semver

I spent most of this year so far figuring out possible designs to solve those problems.

RustWeek + All Hands were phenomenally useful! I worked w/ rustdoc, types, compiler, cargo, and other folks to poke holes in the designs and then patch them.

Thank you @rustnl for making it happen!

#rust #rustlang #semver #rustweek #rustweek2026

Built-in `assert_matches!()` and more in Rust 1.96 🎉

https://blog.rust-lang.org/2026/05/28/Rust-1.96.0/

#rust #rustlang

New cargo-semver-checks release 🦀

I'm hard at work on solving type checking lints, so this one is just a maintenance release — one new lint plus some bug fixes. Enjoy!
https://github.com/obi1kenobi/cargo-semver-checks/releases/tag/v0.48.0

#rust #rustlang #semver

Cursor, 이제 ACP 레지스트리를 통해 JetBrains IDE에서 사용 가능
#RustLang #Rust #RustRover #Aiassistant #News #Acp

https://blog.jetbrains.com/ai/2026/03/cursor-joined-the-acp-registry-and-is-now-live-in-your-jetbrains-ide

Cursor est maintenant Inclus dans le registre ACP et disponible dans les IDE JetBrains
#RustLang #Rust #RustRover #Aiassistant #News #Acp

https://blog.jetbrains.com/ai/2026/03/cursor-est-maintenant-inclus-dans-le-registre-acp-et-disponible-dans-les-ide-jetbrains

Improving Accessibility in JetBrains IDEs: What’s New and What’s Next in 2026
#RustLang #Rust #RustRover #News #Accessibility

https://blog.jetbrains.com/platform/2026/05/improving-accessibility-in-jetbrains-ides-what-s-new-and-what-s-next-in-2026/

What Does It Actually Take for an IDE to Understand Rust?
#RustLang #Rust #Engineering #Industrytrends #Livestream #Rustrover

https://blog.jetbrains.com/rust/2026/05/29/how-rust-ides-understand-code/