security

7 articles · newest first

Software

the WordPress sites getting owned by wp2shell all have one thing in common — and it isn't bad luck

If your WordPress lives on managed hosting, you were probably patched before you'd even read the news. The sites actually exposed to wp2shell share a specific setup — here's whether yours is one of them.

Priya Nair · 27m ago · 8 min

Software

you updated WordPress and moved on. here's the 10-minute audit that tells you if you're actually safe — or already owned

Clicking 'update' closes the door. It doesn't check whether someone already walked through it, or whether the other doors are locked. A practical, no-nonsense checklist for after a critical WordPress vulnerability.

Priya Nair · 27m ago · 9 min

Software

96% of WordPress security holes are in plugins. wp2shell is one of the 4% that should actually scare you

Most WordPress vulnerabilities live in plugins and themes you can uninstall. A flaw in core itself — reachable on a default install with no add-ons — is a different, rarer animal. The data on why wp2shell stands out.

Priya Nair · 27m ago · 8 min

Software

WordPress just updated millions of sites without asking. that's rarer than you think — and here's how to check it worked

The forced auto-update push behind the wp2shell fix is a mechanism WordPress has used only a handful of times. What it is, why they broke the 'we don't touch your site' rule, and how to confirm your install actually got it.

Priya Nair · 27m ago · 8 min

Software

there's a second WordPress bug this month — and this one has no patch, just a plugin you need to switch off tonight

While everyone patched the wp2shell core flaw, a 9.8-rated hole in a popular login plugin quietly went public with no fix available. If you run miniOrange's OAuth SSO, updating WordPress didn't save you.

Priya Nair · 27m ago · 7 min

Software

run Oracle PeopleSoft? the bug that breached 100+ orgs was exploited two weeks before the fix existed

CVE-2026-35273 is a 9.8 pre-auth RCE ShinyHunters used as a zero-day on universities before Oracle had a patch. It's fixed in the July CPU — here's the patch-now checklist, and why patching alone isn't enough.

Priya Nair · 1h ago · 7 min

Software

run WordPress? stop and update right now — this bug hands your entire site to a stranger

no login. no plugin. no weird setup. one anonymous request and a stranger owns a default WordPress site. the fix is out — here's exactly what to check before you assume you're safe.

Priya Nair · 4d ago · 5 min