Webmin supply chain attack (2018)

An unknown threat actor compromised the Webmin build server, and inserted a backdoor RCE vulnerability into the Webmin source code that anyone could exploit if they were aware of its existence. This backdoor persisted for over 15 months, likely being exploited as a 0day by the threat actor, until Webmin identified and removed it.