Dan Goodin / Ars Technica:

Researchers find a yearlong ongoing supply-chain attack targeting malicious and benevolent security personnel and stealing over 390K WordPress credentials  —  A sophisticated and ongoing supply-chain attack operating for the past year has been stealing sensitive login credentials from both malicious …