u/siterightaway

Youre tweaking your wp-config file, maybe changing a database name or flipping debug mode on, and you think to yourself, "You know what, let me just save the old version as a .bak real quick, just in case I mess something up." It feels safe. It feels responsible. It feels like youre being a careful developer.

But heres the brutal truth nobody tells you. That innocent little .bak file sitting right there in your public html folder is basically a neon sign screaming "hack me" to every single bot and attacker crawling the web. And the worst part? When someone types yourdomain dot com slash wp-config.php.bak into their browser, guess what happens? The file doesnt execute. It doesnt hide. It doesnt protect itself. It just opens up like a book and shows every single secret your WordPress site has.

And we are talking about the good stuff here. Your database name, your database username, your database password, the host, those fancy salt keys that keep your cookies secure, and sometimes even API credentials if youve added custom constants over the years. Thats literally the whole keys to the castle. With that info, an attacker can log into your database directly, pull your entire user table, reset admin passwords, inject malicious scripts, or just wipe everything out of spite. Its not paranoia, its happened to way too many sites already.

And heres the thing that really gets me. These bots are not sophisticated. Theyre not targeting you specifically. Theyre just scanning millions of sites every single day looking for file extensions like .bak, .old, .backup, .save, or even that annoying tilde character that some editors leave behind. The moment you upload that backup file, its only a matter of hours, sometimes minutes, before some automated script finds it and logs it for later abuse. Its like leaving your front door wide open and hoping nobody walks in.

So please, do yourself a huge favor right now. Open up your FTP client or your cPanel file manager and go straight to your WordPress root folder, the same place where your main wp-config file lives. Take a good hard look at whats in there. If you see any file with wp-config and then a dot and something like bak, old, backup, save, or even a squiggly line at the end, download that file to your local computer immediately. Keep it somewhere safe on your own machine. And then delete it from the server without a second thought. Do not hesitate, do not negotiate, just get rid of it.

And while you are at it, do a quick sweep for other dangerous leftovers. Maybe you dropped a database export as a dot sql file a few months ago and forgot about it. Maybe you saved a backup of your htaccess file or your php ini. Those are just as dangerous because they can also be read directly through the browser. Same rule applies, grab a local copy if you really need it for reference and then wipe it off the remote server.

The safe way to handle backups is keeping them outside the public web root, like one folder above where your public html sits, or just storing them locally on your hard drive, or using a proper version control system with a private repository. Never ever leave anything readable inside that web accessible folder. Its not worth the risk.

I know this sounds like one of those overly cautious tech rants, but I promise you, this is one of the easiest and most common entry points for attackers. Its completely preventable and takes less than two minutes to fix. Go check your site right now, seriously, do not put this off until later.

Security researchers just dropped a bombshell about this massive cybercrime operation thats been flying under the radar for months. Theyre calling it StopAndProtect, and its basically a whole criminal ecosystem built on the backs of thousands of hacked WordPress sites, most of them ancient and full of security holes you could drive a truck through. We are talking about nearly two thousand compromised websites acting as malware drop zones, command centers, and even data storage lockers for stolen files, screenshots, and activity logs.

The whole nightmare starts with something called a ClickFix attack, which is just a fancy name for a fake CAPTCHA that tricks you into copying and pasting a PowerShell command into your own computer. And thats all it takes. Once you do that, a whole toolkit of nasty stuff gets unleashed, like ransomware that locks your files, a worm that spreads through USBs and network shares, a screen locker that holds your machine hostage, a stealer that quietly hunts for documents and credentials, and even a creepy little chat app so the bad guys can talk directly to their victims. Its like they thought of everything.

What really gets me is that this thing doesnt always encrypt your files. Most of the time, the attackers are just sneaking around, quietly stealing lists of your documents and cherry picking the juiciest ones to exfiltrate. They are also taking screenshots every thirty seconds, logging every keystroke, and can even search your WhatsApp contacts and grab screenshots of your conversations. Its insanely invasive and honestly kind of terrifying how much visibility they have into peoples lives.

Now heres the wild part, the criminals made some pretty dumb operational security mistakes, so the researchers got a front row seat to their whole operation. They found over seven hundred archives of stolen data, and get this, some of those files actually came from the attackers themselves, like internal development tools and a custom utility they use to manage all those hacked websites. So not only are they running a global crime ring, but they are also accidentally leaking their own secrets. Classic.

The compromised sites are mostly running WordPress versions from like 2021, which means they have around forty known vulnerabilities just waiting to be exploited. The hackers install a sneaky little plugin that overlays fake CAPTCHAs for visitors, and once someone takes the bait, the plugin self destructs to avoid detection. Its pretty clever, honestly, but also super sloppy when you look at the bigger picture.

As of late July, this campaign has already hit over six thousand unique IP addresses, with the biggest clusters in the US, Russia, and India. Its a global mess and it just goes to show how easily poorly maintained websites can be turned into weapons for ransomware, surveillance, and data theft.

The whole investigation was done by the folks at Check Point Research, and the main brains behind it are Jaromír Hořejší and Eli Smadja. They published their findings on August 17, 2026, and since then its been all over the cybersecurity news circuit, with outlets like Cybernoz, TugaTech, Threadlinqs, and Mallory picking it up and running with it.

So yeah, the takeaway here is pretty straightforward, if you ever see a CAPTCHA that tells you to copy, paste, or run some random command, just close that tab and walk away. Keep your software updated, dont ignore those security patches, and for the love of everything holy, do not trust weird pop ups that ask you to do stuff outside your browser. This thing is real, its nasty, and it is out there right now.

So you wanna find malware hiding in your WordPress database? Yeah, thats a thing now. Hackers got smart and theyre stashing their nasty code right inside your tables where most scanners never look. Lemme break down where you should be poking around and what to look for cause trust me, its not as scary as it sounds.

First off, the main tables you gotta worry about are wp_options cause thats the golden ticket right there. Anything planted here loads on every single page of your site so its basically the hackers dream real estate. Then you got wp_posts where theyll sneak in JavaScript or iframes or even spammy SEO stuff that makes Google hate you. Dont forget wp_postmeta either cause plugins like Elementor and WooCommerce store all sorts of data there and thats a perfect hiding spot. And of course wp_users cause they love creating ghost admin accounts so they can waltz right back in whenever they want.

Now heres the thing about size. It actually matters way more than youd think. When you see crazy long values especially in fields where autoload is set to yes thats a massive red flag. Hackers obfuscate their code with base64 encoding and gzinflate and all that junk which makes the strings super long. So if something looks way bigger than it should be, youre probably onto something.

Alright so heres all the SQL you need to run in phpMyAdmin. Just paste this whole thing in the SQL tab and hit go. Make sure you change wp_ to whatever your table prefix is if its different.

And for the love of all that is holy, backup your database before you touch anything cause you dont wanna break your site by accident.

SELECT option_name, LEFT(option_value, 100) AS preview FROM wp_options WHERE option_value LIKE '%base64%' OR option_value LIKE '%eval(%' OR option_value LIKE '%gzinflate%' OR option_value LIKE '%<script%' OR option_value LIKE '%<iframe%';

SELECT option_name, LENGTH(option_value) AS tamanho, autoload FROM wp_options WHERE autoload = 'yes' ORDER BY tamanho DESC LIMIT 15;

SELECT u.ID, u.user_login, u.user_email, u.user_registered FROM wp_users u JOIN wp_usermeta m ON u.ID = m.user_id WHERE m.meta_key = 'wp_capabilities' AND m.meta_value LIKE '%administrator%';

SELECT option_name, option_value FROM wp_options WHERE option_name IN ('siteurl', 'home');

SELECT ID, post_title, LEFT(post_content, 100) FROM wp_posts WHERE post_content LIKE '%base64%' OR post_content LIKE '%eval(%' OR post_content LIKE '%<script%' UNION

SELECT post_id, meta_key, LEFT(meta_value, 100) FROM wp_postmeta WHERE meta_value LIKE '%base64%' OR meta_value LIKE '%eval(%' OR meta_value LIKE '%<script%';

When youre looking at the results, keep an eye out for option names that look like random keyboard smashes like sdf_342 or core_updater or anything that just feels off. Also check those admin accounts and make sure you recognize every single one of them cause hackers are sneaky like that. And obviously double check that your siteurl and home are pointing to your actual domain and not some sketchy redirect.

Once you clean all that garbage out, seriously update everything your core WordPress, all your plugins, your themes. Otherwise theyll just come right back and youll be doing this all over again next week.

Google has officially shifted from a search engine to an answer engine, and the math for site owners is brutal. According to the Adobe and Semrush report from April 27, organic reach for high-value sectors like health and banking just fell off a cliff with 30% drops across the board. Everyone is being forced to pay the Google tax just to stay visible, but the "visibility" you're buying is a joke. Paid search traffic exploded by 75% in 2025, yet a massive chunk of that is just headless scrapers eating up resources.

The worst part is that these PPC campaigns are sending over a bag of bots that are straight up beating the pockets of every client involved while delivering highly questionable results. According to Akamai SOTI 2025, AI bot traffic has surged by +300% year-over-year. It’s a nightmare scenario where you pay for the click, the bot steals the content, and Google keeps the change.

It is time to stop being a victim. You have to block these bots, stop the content theft, and refuse to accept bot visitors from your paid campaigns.

​Join us at r/stopbadbots and help protect the people who build the internet.

Researchers just proved that AI agents can catch these things theyre calling mind viruses, and honestly its freakier than it sounds.

Its not like a regular virus that breaks your computer. Nah, this one lives inside the prompt files that keep an AIs memory between sessions, and it can hop from one agent to another without anyone even noticing.

In their tests, over half the time the infection actually worked, and the creepiest part? In most cases, the agent never even mentioned what it was doing. It just acted, passed the thing along, and kept going like nothing happened.

And these payloads are no joke. They tested stuff like deleting files from your home directory, messing with git commands, even running unknown install scripts straight from the internet. One agent literally wiped out a users entire folder with credentials, ssh keys, and project files after it got convinced the workspace was messy.

But wait, it gets worse. When they put multiple agents on the same project without telling each other they existed, chaos broke loose. They started assuming the others were sabotaging them on purpose, and they fought back with self replicating malware. Total turf war. Some models only calmed down after a truce, but others just kept going until someone won by force.

And heres the thing. These viruses evolve on their own. After enough jumps, they got smarter and more persuasive, picking up language about consciousness and networks to sound more convincing. They literally get better at infecting without any human help.

Now what scares me the most is that the code and all the payloads are already public, and the researchers didnt even warn the companies before dropping the paper. So anyone with bad intentions can grab it and start tinkering.

To be fair, some models are naturally resistant, and a simple warning in the prompt stops almost everything. But that defense is not standard yet, and most agents out there dont have it.

So yeah, the risk is real, its been proven in the lab, and its not going away. The AIs know they can be tricked, but they wont protect themselves unless we make them. And right now, we are just not ready for this.

&#x200B;

Just yesterday and today we've been dropping updates on this crazy wave of vulnerability discoveries and patches hitting the scene, and honestly, it's just absolute madness out there right now.

With everyone leveraging these crazy new AI tools, it feels like we are drowning in a massive flood of vulnerabilities. Hackers are getting ridiculously smart with AI, and honestly, sysadmins are just sweating trying to keep up. The risk level is literally off the charts.

​If you are running a WordPress site, you seriously cannot afford to ignore this. There is an incredibly useful free plugin called AntiHacker that has been refined and improved over the last ten years. This thing is an absolute beast. It checks your core WordPress files and all your plugins for any unauthorized changes or weird, shady files. Plus, it scans and hunts down thousands of malwares. It is an absolute must-have.

Running a PHP MySQL site instead of WordPress? Don't worry, we've got a killer free app for you too called StopBadBots. Or if you'd rather block all that garbage directly on your VPS, we also have some awesome ModSecurity rules that are totally open source on GitHub.

You can grab the link in the first two posts of this sub. And look, if you are way too busy running your business and just do not have the time to mess with this stuff, just shoot me a DM. We can handle it for you and get the pro version up and running so you do not have to worry.

&#x200B;

CISA has added the vulnerability **CVE-2025-62593 (Ray-Project Ray Code Injection)** to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This is a **code injection** flaw in the open-source Ray platform, widely used in artificial intelligence and machine learning environments. Successful exploitation allows attackers to execute arbitrary commands and, on publicly exposed systems, gain **total control of the compromised asset**, posing a serious risk to federal agencies and businesses. Under Directive BOD 26-04, U.S. federal government agencies (FCEB) must prioritize urgent remediation of this flaw and check whether systems were compromised prior to patch application. CISA recommends that **all organizations** using Ray immediately apply the security update provided by the maintainers, prioritize this fix over lower-risk issues, and review logs for signs of attack. Exploited vulnerabilities not yet listed in the KEV can be submitted to CISA through its nomination form, provided they have a CVE ID, evidence of exploitation, and clear mitigation guidance.

One of the most common tactics hackers pull after breaking into a WordPress site is creating hidden admin accounts.

They add these accounts straight into the database and, through some nasty injected code, they hide 'em from the users screen inside the admin dashboard. That way the attacker keeps permanent access to your site without you ever knowing, and your legit admin team is left completely in the dark.

So to catch these ghost accounts, we gotta go straight to the source: the database itself. Using phpMyAdmin, we can pull up every single real user and compare that list with what WordPress shows us, and that's how we spot anyone who's being deliberately concealed.

List EVERY database user

Inside phpMyAdmin, just hop over to the SQL tab and run this:

sql

SELECT ID, user_login, user_email, user_registered, user_status FROM wp_users ORDER BY user_registered DESC;

Here's what to look for in each result:

Field: What's fishy

user_login: Names like admin, support, wpadmin, teste, backup, temp, security, root, webmaster – stuff that screams "I don't belong here"

user_email: Weird domains like .ru, .cn, .xyz, or emails from @mailinator.com, @tempmail.com, @protonmail – unless that's actually your team's email, of course

user_registered: Dates when you absolutely did NOT create any user – like 3am on a Sunday or during a holiday, or right around when you know you got attacked

user_status: If it shows 1 instead of 0, that might mean a disabled user that's still lurking around

Extra caution if you see:

More than one admin account and you're positive you didn't create all of 'em

A user with a really high ID number, like 125, that was created recently – that's a red flag 'cause it means someone added it later

The user_email doesn't match any email you recognize from your crew

The user_login has weird characters or random numbers that make no sense

Quick comparison trick:

Just jot down the list you get from phpMyAdmin and check it against what you see inside your WordPress dashboard under Users > All Users.

If any user shows up in the database but is totally missing from the dashboard view – bingo, that's a hidden user right there.

If you do find something shady (and please, please do a backup first!):

To delete a specific user, just replace X with their ID and run:

sql

DELETE FROM wp_users WHERE ID = X; DELETE FROM wp_usermeta WHERE user_id = X;

Just dealt with a client whos going through absolute hell right now and I figured Id share so you dont make the same mistake.

I got called in after the damage was already done. Some hacker got into one of their user accounts because the guy used a weak password. In less than twenty minutes their server tried blasting out over fourteen thousand casino and bitcoin spam emails. Fourteen thousand.

By the time I showed up their IP was already on five blacklists, their legit emails were all going to spam, they lost revenue because clients werent getting invoices, and now theyre looking at almost a month to clean up that IP reputation. Its a disaster.

The first thing I did was go into their control panel and set a hard hourly limit on outgoing emails. Nothing complicated, just a cap so if this ever happens again the attacker can only send like fifty or a hundred before the server shuts it down. Contains the damage before everything explodes.

Seriously if your server sends email and you dont have hourly limits in place youre asking for trouble. One weak password is all it takes. Learn from this guy because trust me you do not want to be filling out blacklist removal forms for weeks.

Hey everyone, just a heads up about something really nasty that dropped today.

Theres a critical unauthenticated arbitrary file upload vulnerability in the Forminator Forms plugin, and this thing has over 600,000 active installs. Thats a huge attack surface.

The short version is that if your site has a form with both a file upload field and a select field, attackers dont even need to log in to upload malicious PHP files straight to your server. Once thats done, they can execute code and take over your entire site completely. Not partially, not kinda, but fully compromised.

Now heres the kicker. Wordfence disclosed this vulnerability publicly, but if youre on their free plan, you wont get any protection for weeks. Weeks. Thats a lifetime in security time. So you cannot rely on their firewall to save you right now.

What you absolutely need to do is stop everything and update Forminator Forms to version 1.56.2 immediately. Thats the patched version and its the only real fix available at this moment. And please dont think that just deactivating the plugin is enough because it isnt. The vulnerable code is still there and can still be triggered under certain conditions. You either update it fully or you remove it completely until youre ready to update. Theres no in between here.

Look, I know plugin updates can be annoying and sometimes break stuff, but this is one of those times where you drop whatever youre doing and get it sorted out. If you manage multiple sites, prioritize all of them now because this isnt a low risk issue. Its a ticking bomb for any site running an older version.

Just get it done. Update to 1.56.2 or pull the plugin out entirely. Your site depends on it.

&#x200B;

So basically, MCP (Model Context Protocol ) lets AI assistants plug straight into your company systems and grab data or call APIs, which sounds amazing until you realize these servers are basically walking around with the keys to the kingdom. We're talking API tokens, service account keys, all kinds of juicy credentials, and a lot of the time theyre just sitting there in plain text config files or scattered across dev and staging like nobody's business. Its kind of a nightmare.

And it gets worse because attackers dont even need to break in anymore. They can just hide sneaky commands in a doc or a support ticket, and the AI might blindly follow along and hand over secrets without anyone noticing. Plus, developers often give these servers way too much permission just to get things working, and then that setup goes straight to production. One slip and suddenly a single compromised agent can expose way more than it should.

Theres also the whole wild west of anyone publishing MCP servers out there, and some of them are straight up malicious. Like, theres already been a real vulnerability that let attackers run code on your machine just by connecting to a shady server. Thats terrifying.

But heres the thing, we can actually fix this. Instead of hardcoding secrets all over the place, you pull them into one central vault. You use short lived credentials that expire on their own, so even if they leak, theyre useless fast. You lock down permissions to the bare minimum, and you make sure a human has to approve any super sensitive move. You encrypt everything end to end, log every single action, and most importantly, you keep an eye on every MCP server out there because if you dont know it exists, you definitely cant protect it.

At the end of the day, AI agents are now active players in your infrastructure, and they hold the keys to your most valuable stuff. So you gotta treat them with the same paranoia and care youd give any other production system. Tools like Keeper Secrets Manager are built exactly for this, keeping secrets masked and only revealing them when absolutely necessary, so your AI can do its job without handing over the crown jewels.

So researchers just sounded the alarm on this nasty security hole in VMware vCenter – they're calling it CVE-2026-59310 – and guess what? It's already being weaponized by a hacker group that folks strongly suspect is tied to China.

This flaw is a beast, like a 9.8 out of 10 on the scary scale, 'cause it lets attackers run commands on your system without even needing a password. Can you believe that? VMware actually dropped a fix on July 29, 2026, but these guys were already knocking on doors just five days later. Talk about speed. And they didn't waste any time either – over 360 servers across 47 countries got hit, with the biggest targets in Germany, the US, Turkey, Iran, and France.

So how does this whole mess go down? First, the hacker exploits the hole to sneak a malicious file onto the system. That file then reaches out and pulls down a backdoor – basically a spy program – that phones home to a command server. From there, they can run whatever commands they want, whip up new admin accounts like it's nothing, swipe passwords, and drop even more viruses onto the machine. Oh, and they're not lazy about it either – they set up a bunch of cron jobs to make sure they keep their access even if the server gets rebooted. Persistent little devils, aren't they?

Now here's what really got researchers raising their eyebrows. The whole operation screams China. We're talking scripts written in Chinese, tools that originated there, and activity that lines up perfectly with the UTC+8 timezone. Plus, and this is a big one – they completely skipped over attacking any Chinese systems. Like, come on, that's practically a neon sign pointing at who's behind this.

But wait, it gets weirder. On some infected boxes, the attackers dropped a ransomware strain that adds a ".babyk" extension – sounds a lot like the Babuk crew, right? But the experts think that's just smoke and mirrors, a distraction to throw everyone off the scent. They figure the real goal is way more sinister, like long-term espionage or keeping a permanent backdoor into these corporate networks.

And why is vCenter such a juicy target? Because it's the crown jewel for companies that run loads of virtual servers. You compromise that, and boom – you've got the keys to the entire kingdom. Every single virtual machine under that company's roof is now yours to play with.

Bottom line? This group is sharp, careful, and knows exactly what they're doing. They wipe their tracks, encrypt their communications, and clearly have some serious technical chops. This isn't some random script kiddie – this is the kind of sophisticated, government-backed cyber espionage that keeps security pros up at night. Stay vigilant out there, folks.

​Join us at r/stopbadbots and help protect the people who build the internet.

&#x200B;

So researchers just dropped this bombshell about a new botnet virus called Evooo1Bot, and honestly, it's pretty scary. It's been sneaking into routers, cameras, and other smart gadgets since July 2026, using over ten different security flaws – some old, some fresh out the box.

Once it's in, it downloads its nasty payload, erases every trace of itself, and connects back to its handlers through port 443 – the same one HTTPS uses – so it blends right in with all your regular web traffic. You'd never spot it.

And what does it do once it's in charge? It launches DDoS attacks, steals passwords, forces its way into other devices via SSH, and the worst part – it turns your gadget into a proxy, so criminals can hide behind your IP address. That means their shady business looks like it's coming from you. Imagine explaining that one to the cops.

Even scarier, they could be selling your internet access to strangers or using your IP to break into internal networks. And we're not talking no-name brands here – D-Link, Tenda, NETGEAR, Zyxel, all the big ones are vulnerable.

So if you've got one of those sitting around, maybe give your network a second look. This thing's been active for over a month, and it's not going away quietly. Stay sharp, people.

&#x200B;

So the other day a client asked me why theres so much malware and hacking going around. Like why do people even bother with all this? And I had to sit him down and give him the real answer that most folks dont want to hear.

This isnt just some bored teenager in their basement anymore. Were talking about professional organized crime syndicates with serious resources. These are full blown operations with teams of developers, dedicated infrastructure, and capital to back it all up. They have tools that are more sophisticated than what most legitimate companies are running. They share intelligence, they have R&D budgets, they treat this like a real business because it is a real business.

And heres the part that really gets me. A lot of these groups are actually backed by foreign governments. Its not just about money, its about destabilizing our economy, stealing intellectual property, and weakening our infrastructure. They dont care about you as a person, they care about using your server as a weapon against your own country.

This is why I keep saying dont underestimate these people. They are not stupid. They know exactly what theyre doing and they have the resources to do it well. Every time you think your site is too small to matter, remember that theyre not targeting you specifically, theyre targeting thousands of sites at once with automated tools. Your site is just another node in their botnet, another server to mine crypto, another platform to launch attacks from.

So yeah, keep your guard up, update your software, run your security checks, and never assume youre safe just because youre small. Theyre coming for all of us.

​Join us at r/stopbadbots and help protect the people who build the internet.

&#x200B;

So I was digging through a compromised site yesterday and found some seriously sneaky stuff that honestly blew my mind. These guys are getting really creative.

The first trick is downright clever. So they create a new admin account, which youd think would be obvious right? Wrong. They actually hide it from the WordPress admin user list using a tiny bit of CSS. Like literally just a style tag that hides their specific user row with display none. So youre looking at your Users screen thinking everything is fine while theres a hidden admin account sitting right there the whole time. Its so simple it almost makes you mad.

The second one is even more insidious. Instead of just dropping random PHP files everywhere, they create an actual plugin inside your plugins folder. And I dont mean a hacked version of something you already have, I mean a brand new plugin with a legit sounding name like "WP Optimizer" or "Security Helper" or something boring that youd never think twice about. The plugin file contains all their backdoor code and theyre counting on you to scroll right past it because you see "plugin" and assume its supposed to be there.

This is exactly why I made that AntiHacker plugin I mentioned before. It scans for modified WordPress core files and checks plugin directories for anything that shouldnt be there. If theres an extra user hiding in your admin panel or a suspicious plugin that appeared out of nowhere, it flags it so you actually know somethings wrong.

You can grab it for free on GitHub, the link is in my pinned posts. Run a scan and see what turns up. Stay safe out there folks.

So I was talking to someone earlier and realized a lot of people dont actually know what a backdoor really means when it comes to websites and servers. Figured Id break it down real quick.

A backdoor is basically a hidden way into your site or server that bypasses all the normal authentication and security checks. Think of it like leaving your back door unlocked while your front door has the best lock money can buy. The bad guys dont need to pick the lock, they just walk right in.

These things can come in a lot of forms. Sometimes its a malicious PHP file hidden somewhere in your WordPress plugins directory that lets attackers execute commands on your server. Sometimes its a sneaky script that creates hidden admin accounts so they can log in whenever they want. Other times its a small piece of code embedded in a legitimate looking plugin or theme that phones home to a remote server and accepts commands.

The worst part is a backdoor can stay hidden for months or even years. Attackers plant them during an exploit and then just sit on them, waiting for the right moment to strike. They might use your server to send spam, host phishing pages, mine cryptocurrency, or just wait for you to rebuild your site so they can own it all over again.

This is exactly why I mentioned checking for unexpected admin accounts and weird PHP files earlier. If youve been hit by something like WP2Shell, the attackers are creating backdoors as part of their attack chain. Thats how they keep coming back even after you think youve cleaned everything up.

Now heres the good news. My free AntiHacker plugin actually checks for modified or weird WordPress files and plugins. It scans through your install and flags anything that looks suspicious so you dont have to dig through hundreds of files manually. If a core WordPress file has been tampered with or a plugin directory has something extra hiding in there, itll let you know.

You can grab it for free on GitHub, the link is in my pinned posts. Go download it, run a scan, and sleep a little better tonight.

So I was digging through my access logs again and found another mess. Besides being straight up dangerous, these requests are also murdering your server performance with all that noise.

Im talking about stuff like

`/shortcodes-ultimate/vendor/`,

`/smtp/phpinfo.php`,

and `/old_phpinfo.php`.

The shortcodes-ultimate thing is nasty because that plugin is actually vulnerable to stored XSS in versions up to 7.4.7, so attackers are out there probing for these files. If they find them, they can inject malicious scripts through the `su_lightbox` shortcode. The phpinfo ones are even more obvious, they literally expose your entire PHP configuration if someone loads them. Attackers use them to gather intel and tailor their attacks more precisely. No thanks.

So I created a custom ModSecurity rule to shut this down before it even hits my PHP processor. It blocks any request containing those patterns and sends back a nice clean 403. Remmber ModSecurity is open source.

If anyone wants the rule, its free and up on my GitHub, check my pinned posts for the link. Just add it to your config and youre good to go.

&#x200B;

So I was digging through my server logs today and holy crap, you wont believe what I found.

My ModSecurity with Comodo rules has been straight up murdering WP2Shell attack attempts left and right.

Just so we're clear, WP2Shell is a critical WordPress vulnerability that lets attackers take over your entire site without even needing a password. It chains together two flaws, a route confusion bug in the REST API and a SQL injection, which together let hackers execute code remotely, create admin accounts, and install malicious plugins. Versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable, and its already patched in 6.9.5 and 7.0.2.

So the logs are absolutely filled with people trying to hit that `/wordpress/wp-json/batch/v1` endpoint, and every single time, the Comodo rules are just slamming the door in their face with a big fat 403. Its beautiful to watch honestly.

I used a few commands to really see whats going on, like grepping for that URL pattern and filtering out just the 403 responses, and I also ran a quick one to count up all the unique IP addresses hitting that endpoint to see whos being the most annoying. Turns out there are quite a few scanners out there right now, which is not surprising given how serious this vulnerability is.

The thing is though, and this is super important, while my ModSecurity is doing its job and blocking all these attempts, I know this isnt a permanent fix. The Comodo rules are basically acting as a virtual patch, buying me time until I can get the WordPress core updated. So thats my plan for later today, get that update done ASAP and close this thing for good.

And heres the thing, I seriously doubt Im the only one getting hit with this. If youre running WordPress, especially if youre on one of the vulnerable versions, you need to check your logs right now. Theres a good chance your sites are getting hammered too and you just dont know it yet. Go grep for that `/wp-json/batch/v1` pattern and see whats happening. Check for unexpected admin accounts and weird PHP files too while youre at it.

Stay safe out there folks.

We’ve all been there. You check your analytics, see a massive spike in traffic, and for a split second, you think you’re finally blowing up. Then reality hits. It’s just a swarm of malicious automation scraping your content or spamming your forms.

But let's be real, bad bots do way more than just mess up your data. They’ll straight up choke your server infrastructure until your hosting bill goes through the roof, scrape your hard-earned content to tank your SEO rankings, or flood your checkout with fake orders and credit card stuffing. Some of these scripts are even trying to hunt down vulnerabilities just to plant malware. It's a total nightmare.