Smart Slider 3 Pro update infrastructure compromised to distribute backdoored release

On 7 April 2026, unauthorized actors gained access to Smart Slider 3 Pro's update infrastructure and made malicious version 3.5.1.35 available through the trusted update system for approximately six hours. The weaponized release could create unauthorized administrator accounts, execute commands, establish persistent backdoors and access credentials on WordPress and Joomla installations. Nextend shut down its update servers, removed the malicious version and released a clean replacement. The compromise of the legitimate vendor update channel constitutes a direct software-supply-chain data-integrity impact.