Nov 11, 2026 · @Thomas J. Raef One site, three days, 400 accounts On November 5, an attacker broke into a single website on a Hostinger shared server in Phoenix. The way in was a vulnerable content management system (CMS) on one customer’s site. Nothing unusual so far. Sites get compromised this way every day….
Nov 7, 2026 · @Thomas J. Raef For a few seconds during every WordPress core update before 7.1.4, a complete, unconfigured copy of WordPress sat at a guessable URL on your site. Attackers are now hammering that window, and on November 3, 2026, CISA added CVE-2026-119977 (CVSS 8.1) to its Known Exploited Vulnerabilities catalog. Credit…
Oct 21, 2026 · @Thomas J. Raef What happened PHP shipped an out-of-band release on 21 October 2026 at 14:00 UTC fixing two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. The details leaked a day early, which gave everyone an unusual thing: roughly 20 hours of warning with no…
Oct 12, 2026 · @Thomas J. Raef A WordPress site was spending most of its server time answering one file, and almost every request said it came from Jetpack. It didn’t. We found it during a review of one site’s access logs. Then we went looking for it everywhere else: 976 WordPress sites across six…
I’ve worked in WordPress security for 18 years. We Watch Your Website has been cleaning and protecting sites since 2007, and today we watch close to 4 million of them. I’ve seen just about every way a plugin can go wrong. So when I started building an AI-assisted analyzer to find vulnerabilities in WordPress plugins,…
When a customer reports “something is filling up disk space,” the instinct is to look for a runaway log file or a misconfigured backup job. Most of the time, that’s exactly what it is. This time, it wasn’t, and what we found underneath is a good case study in how modern WordPress compromises are built…
On September 14, 2026, attackers compromised the Admin Menu Editor Pro update server and pushed malware to thousands of WordPress sites. Here is how we found it, traced it, and what you need to do right now. September 15, 2026 · We Watch Your Website Security Team · Supply Chain Action Required If you or…
Moving faster is more expensive On September 8, 2026, Microsoft shipped the largest Patch Tuesday in its history: 974 CVEs, more than any single release the company has ever issued, blowing past the previous record of 570 CVEs set just two months earlier in July. Microsoft has openly attributed part of the surge to MDASH,…
Most WordPress cleanups are boring, and that’s how you want them. You find the bad file, you delete the bad file, you patch the hole it came through, you’re done. This one was not boring. It’s the kind of infection that makes you doubt your own eyes — you delete a file, refresh, and it’s…
A new client contacted us regarding a site that continually reinfected within minutes of every cleanup. The reason was not a file anyone had missed. The malware had turned the database into a mirror of itself, and every copy knew how to rebuild every other copy. The site had been through a partial remediation months…