Blog

Notes from the ops room.

Hosting, infrastructure, development, and SEO — written by the people doing the work.

Latest Jun 23, 2026 Security

ShapedPlugin's Official Update Server Delivered Backdoors for 28 Days

Attackers compromised ShapedPlugin's build pipeline on May 21 and used the company's own official update server to push credential-stealing backdoors to WordPress sites running three premium plugins — silently harvesting admin passwords, 2F...

Read article

Jun 22, 2026 Security

Operation Endgame Cleaned 15,000 WordPress Sites — Yours Could Be Next

International law enforcement just dismantled SocGholish, the malware network that turned nearly 15,000 legitimate WordP...

Read article

Jun 21, 2026 Security

FortiBleed: 86,000 Fortinet Firewalls Compromised — Is Your VPN in the Dataset?

A Russian-speaking threat group extracted working credentials from more than 86,000 FortiGate firewalls across 194 count...

Read article

Jun 20, 2026 WordPress

Avada Builder CVE-2026-8713: Delete wp-config.php, No Login Required

A path traversal flaw in Avada's form-builder privacy routine lets any unauthenticated attacker delete wp-config.php — f...

Read article

Notes from the ops room.

ShapedPlugin's Official Update Server Delivered Backdoors for 28 Days

More articles

Operation Endgame Cleaned 15,000 WordPress Sites — Yours Could Be Next

FortiBleed: 86,000 Fortinet Firewalls Compromised — Is Your VPN in the Dataset?

Avada Builder CVE-2026-8713: Delete wp-config.php, No Login Required

More from the blog

DragonForce Hid Ransomware C2 Inside Microsoft Teams for Two Months

PHP SOAP Extension RCE (CVE-2026-6722): CVSS 9.8, Patch Now

Joomla JCE CVE-2026-48907: CVSS 10.0 Web Shell, No Login Required

Two LiteSpeed cPanel Bugs Are Handing Attackers Root — One CISA Deadline Is Today

Check Point VPN Zero-Day Lets Ransomware Skip the Password

Agentjacking: Fake Sentry Errors Are Hijacking AI Coding Agents

Oracle PeopleSoft Zero-Day (CVE-2026-35273): 100+ Orgs Breached Before a Patch Existed

UpdraftPlus Auth Bypass (CVE-2026-10795) Puts 3 Million WordPress Sites at Risk

June 2026 Patch Tuesday: Wormable Kernel Bug, Exchange Under Active Attack

Claude Fable 5 Is Out. Here's What Matters for Your Business.