Following Layoffs, Automattic Employees Discover Leak-Catching Watermarks

An anonymous reader quotes a report from 404 Media: As part of the company's months-long obsession with catching employees leaking internal developments to the press, staff at Wordpress parent company Automattic recently noticed individually-unique watermarks on internal sites, according to employees who spoke to 404 Media. Automattic added the watermarks to an internal employee communications platform called P2. P2 is a WordPress product other workplaces can also use. There are hundreds of P2 sites across teams at Automattic alone; many are team-specific, but some are company-wide for announcements. The watermarks in Automattic's P2 instance are nearly invisible, rendered as a pattern overlaid on the site's white page backgrounds. Zooming in or manually changing the background color reveals the pattern. If, for example, a journalist published a screenshot leaked to them that was taken from P2, Automattic could theoretically identify the employee who shared it.

In October, as part of a series of buyout offers meant to test employee's loyalty to his leadership, Automattic CEO Matt Mullenweg issued a threat for anyone speaking to the press, saying they should "exit gracefully, or be fired tomorrow with no severance." Earlier this month, the company laid off nearly 300 people. [...] It's not clear when the watermarks started appearing on P2, and Automattic has not responded to a request for comment. But Mullenweg has been warring with web hosting platform WP Engine -- and as the story has developed, seemingly with his own staff -- since last year. [...] One Automattic employee told me they don't think anyone is shocked by the watermarking, considering Mullenweg's ongoing campaign to find leakers, but that it's still adding to the uncertain, demoralized environment at the company. "Can't help but feel even more paranoid now," they said.

Read more of this story at Slashdot.

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - Following Layoffs, Automattic Employees Discover Leak-Catching Watermarks
id: 7fa7ddba-6a56-46db-b97f-6eebbb6d6ec4
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "Following Layoffs, Automattic " ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Following Layoffs Automattic Employees D")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Following Layoffs Automattic Employees D*"

CommonSecurityLog
| where Message has "Following Layoffs Automattic Employees D"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc