What if a malicious actor could hijack the update server for your favorite CMS? I built a full lab scenario to show how it’s possible — and how to defend against it.
- MITM, rogue CA, fake update feeds (release-history.xml), trojanized package, RCE + persistence
- Everything documented: attack steps, screenshots, scripts (in the PDF), hardening tips
- NOT a Drupal 0-day — just a realistic simulation for security awareness
Why does it matter?
Supply chain attacks are not theoretical anymore. This demo can help Blue Teams, Red Teams, devs, and trainers build better defenses and awareness.
👉 [See the repo & full PDF PoC] GitHub repo: https://github.com/privlabs/-Supply-Chain-Attack-Simulation-on-Drupal-RCE-via-Malicious-Update-Server-PoC-not-a-CVE-
Questions, feedback, want to collaborate? DM or email me (contact in README).
All lab, all safe, no harm to real-world systems!
Top comments (0)