Most WordPress cleanups are boring, and that’s how you want them. You find the bad file, you delete the bad file, you patch the hole it came through, you’re done. This one was not boring. It’s the kind of infection that makes you doubt your own eyes — you delete a file, refresh, and it’s…
A new client contacted us regarding a site that continually reinfected within minutes of every cleanup. The reason was not a file anyone had missed. The malware had turned the database into a mirror of itself, and every copy knew how to rebuild every other copy. The site had been through a partial remediation months…
On July 17, Patchstack published an account of how quickly attackers weaponised the WordPress core RCE chain — CVE-2026-60137 and CVE-2026-63030 — measuring roughly ninety minutes from public patch to live exploitation attempts. Their post closed with a section on what to grep for in your own logs. We took them up on it. Sitting…
What we saw We monitor traffic across the sites we watch, and we track IP addresses with a history of malicious behavior. A pattern kept surfacing in the logs. One flagged address would visit a site briefly, touching the kind of paths that reveal which plugins are installed. Reconnaissance, essentially, building an inventory of what…
On the dependency responsibility gap in AI-built apps, and the 89 seconds that explain it. By Tom Raef, We Watch Your Website On March 31, 2026, a malicious version of axios went live on npm. The first machine was infected 89 seconds later. Nobody approved it. No developer read a changelog, clicked update, or weighed…
I run a security pipeline that tears apart AI-generated web apps. This week I pointed it at an invoice and checkout application that was built entirely by an AI app builder. The kind of thing that goes from idea to live, taking-payments URL in an afternoon. It found something that should stop anyone shipping commerce…
By Tom Raef, Founder – We Watch Your Website There’s a moment in every security researcher’s career when something stops being theoretical and becomes undeniably real. For me, that moment came about halfway through this project, when I realized that every single platform we tested, without exception, was telling its users their app was ready…
Four threat actors probed our new server within hours of launch. Here’s exactly what they were looking for and why vibe-coded apps are handing it to them. By Tom Raef, Founder, We Watch Your Website May 25, 2026 We launched a new server this week. Not a WordPress site. A code analysis server, the infrastructure…
Security Advisory | We Watch Your Website The calls started coming in before the coffee cooled. A WordPress site owner — developer by trade, not by security background — had used an AI assistant to build a custom plugin over a weekend. It handled contact form submissions, wrote data to a database, and passed a few…
There are new broad PCI DSS 4.0 compliance requirements that apply to eCommerce websites. The new requirements add a Level 4 which applies to small eCommerce websites handling less than 20,000 transactions per year. These websites did not previously have to complete requirements for PCI DSS version 3. The deadline for compliance with these is…