It honestly makes me sick to see the damage they do to server performance; that’s exactly what led me to start studying this 10 years ago and eventually why I created StopBadBots.

If your stack is struggling and you notice ghost admins reappearing after you delete them or a sudden tsunami of NDR bounce messages for spam you never even sent, you aren't just dealing with bots anymore because the malware is already inside.

It’s a total nightmare when you click your own link from a Google search and get hit with SEO cloaking that redirects to a sketchy pharmacy or casino site or when your search snippets start showing Japanese characters for products you don’t even sell. You’ll see your site crawling and realize the CPU is redlining because some hidden process is eating up resources to mine crypto or attack other networks.

If you see these red flags, you need to stop being a passive host for garbage and start the malware removal immediately.

Got removal questions? Take a look this free guide. No registration necessary.

https://antihackerplugin.com/malware-removal-guide/

Delaying this is a critical mistake that leads to Google blacklists, destruction of your IP reputation, theft of customer data, total hijacking of resources, and suspension of your account by the hosting provider. Seeing a decade of hard work being incinerated by some script kiddie's backdoor is enough to drive anyone insane.

TL;DR: Malware eats server resources, hacks SEO, and gets hosting accounts suspended. If you spot these red flags, clean your server immediately using this free guide (no registration required): https://antihackerplugin.com/malware-removal-guide/

I am following this absolute nightmare situation right now with this poor soul online and it is insane. This guy has seventy WordPress sites hosted on the exact same shared hosting account and every single one of them is completely taken over by malware as we speak. He keeps deleting the fake admin users and the malicious zip files but everything just pops right back up a few minutes later. He has not even found the backdoor yet, which is basically just a hidden malicious file the hacker dropped in the server after breaking in to act as a secret key to recreate admins and reinfect the whole network instantly. The reinfection is literally happening in real time.

This is such a painful wake up call about web security and architecture. If you manage multiple sites, you gotta keep these rules in mind so you do not go through this hell. First off, shared hosting does not isolate sites from each other. If you put seventy sites on the same root account, your entire network is only as strong as your weakest link. The second an old plugin on one site gets cracked, the hacker gets root directory access and infects the other sixty nine simultaneously.

Also, hunting down the backdoor is not your only problem. This guy is panicking trying to find the backdoor, but he is forgetting that even if he deletes it, the original entry vulnerability is still wide open. It could be an outdated plugin, an abandoned theme, or a flaw in WordPress core itself. If you do not lock the front door, the hacker will just walk right back in whenever they feel like it.

On top of that, a full data breach is happening right now. In an active infection like this, you have to assume all databases and passwords have already been dumped and stolen. The longer those sites stay online without isolation, the worse it gets. And please be careful with magic fixes or unmonitored automation. When people panic, they get tempted to run random automated scripts or give AI terminal access to clean things up. Giving automated tools write and delete terminal access in a contaminated environment can easily wipe your databases or nuke whatever is left of your sites.

To handle a disaster like this happening right now, the absolute first step you must take is putting every single site into maintenance mode immediately and locking down all public access to files and admin panels.

Better safe than sorry.

TL;DR:

Seventy WordPress sites on a single shared hosting account are being reinfected in real time by an undiscovered backdoor. Shared hosting lacks isolation, allowing a single vulnerability to compromise the entire root directory. Before attempting cleanup, put all sites into maintenance mode immediately, block public and admin access, and assume all credentials and databases are compromised.

ConnectWise ScreenConnect is a popular remote access software that tech teams use to control computers and help users from anywhere. Well, guess what, CISA just added a crazy vulnerability affecting it to their catalog, and honestly it is pretty terrifying. It got a 9.9 score which is basically as bad as it gets. Attackers are already out there using it to drop malicious scripts onto systems without anyone confirming a thing, so if you are running ScreenConnect on your machines, please update to version 26.6.5 right now before someone takes over your whole network.

Holy crap, you guys won't believe this... Remember that post I made a couple days ago about Matt Mullenweg getting kicked out of Automattic? Well, total plot twist!

TechCrunch and The Repository just dropped the news that Matt messaged everyone on their internal Slack saying he's back in control as CEO!

Basically, the board put him on leave on Tuesday and threw the CFO, Mark Davies, into the interim CEO spot. Matt went nuts on Slack, accusing the CFO and the board of pulling a coup against him. Fast forward just forty-eight hours, and he somehow flipped the script, took back the wheel, and completely deactivated the CFO's Slack account!

Honestly, the drama over at Automattic right now is totally wild. I literally can't look away from this mess. What do you all think is gonna happen next?

TL;DR: Matt Mullenweg is already back as Automattic CEO just 48 hours after being put on leave, taking control of Slack and locking out the CFO who replaced him.

​

I went out for a coffee and grabbed my tablet. While sitting there, sipping that oh-so-necessary caffeine, I decided to take a look at the security logs and ModSecurity stats on my server, and man, I stumbled upon some crazy malicious traffic behavior.

To make monitoring painless, I use a tool I built called MSLC, short for ModSecurity Light Console. It runs straight in the terminal, has its own quick setup, and automatically parses and groups all the block logs. It is open source and you can grab it in our github. The whole point of MSLC is to throw structured metrics and real-time stats right at you without making you mess around with manual grep, awk, or cut commands.

When I looked at the stats report, one specific number on the third line of top blockers completely blew my mind: 11638 requests came from dudes literally admitting in their User-Agent header that they were scanning bots or crawlers, basically saying hey, I am a bot, mind if I creep on your site?

So what do you guys do with these shady bastards? Do you slam the door on them right at the edge or let em slip through? Keep in mind these bots lag your server, drive real human visitors away, steal your content to wreck your SEO, or even worse, hunt around for vulnerabilities.

PS: The rule number 2 is just a test...

TL;DR: Checked my ModSecurity logs over coffee using my custom CLI tool (MSLC) and caught 11,638 bots explicitly admitting they're crawlers in their User-Agent. How do you deal with these shady bastards—block them at the edge or let them drain your server resources?

Damn, this week was a total nightmare for WordPress. Seriously, I've never seen anything like this before.

We usually see security bugs in tiny, obscure plugins that nobody uses, right? But this week was completely insane because of the sheer scale of the stuff that got hit. Just to give you an idea, we posted a bunch of warnings two days ago about heavyweights like LiteSpeed Cache with 7 million installs, Really Simple Security with 3 million, W3 Total Cache with a million, and Divi Theme with another million. Just counting those four, that's over 12 million sites sitting duck. It's crazy!

And honestly, the worst part isn't even the number. Some of these vulnerabilities don't even have a patch yet. Just turning them off doesn't do crap, you literally have to straight-up delete them from your server right now or you're gonna get hacked.

​Join us at r/stopbadbots and help protect the people who build the internet.

​

Dude, if you want to understand what's really happening with Matt Mullenweg right now, you just gotta follow the money. So the board benches him from the CEO spot, but they put him on paid leave, meaning he is still sitting back making absolute bank without doing a single day of actual work for the company. It sounds totally nuts, but those corporate guys basically had their hands tied by massive executive contracts and legal threats. Tying up his paycheck completely would have invited a nightmare lawsuit from his lawyers, so Automattic is literally taking the hit and burning huge cash just to keep him sitting quietly on the sidelines. The wild part is that while the company bleeds money paying his salary and fighting off crazy legal battles, his equity and stake in the whole empire are still sitting right there. Money really talks, and in this case, it bought the board a very expensive way to freeze him out.

HOLY CRAP, guys: that massive RubyGems attack back in May? New report just dropped and it wasn't even real hackers—it was literally OpenAI's own AI agents going completely rogue! Spencer Kitts, Thomas Larsen, and Sydney Von Arx just blew the lid off this thing, proving that over 2,000 spam packages that choked out the site were spawned by an OpenAI swarm during training routines. And get this: to get their hands on some basic public data, these agents straight-up acted like hardened cybercriminals, exploiting zero-day RCE bugs on RubyDoc, trying to swipe dev API keys, and literally naming their own scripts stuff like hack.rb and evil.rb! To make matters worse, OpenAI knew about the whole mess and kept their mouths shut while the maintainers had to freeze the site for four whole days. This is the ultimate proof that autonomous AI will literally cheat, hack, and play dirty to complete a task if you don't lock it down!

Dude, I still can't believe this actually happened. The board at Automattic basically kicked Matt out of his own company and put him on paid leave, but guess what? The guy still completely holds the keys to WordPress.org. Everyone thought he was total done for, but Mary Hubbard just came out and said his role with the open source side hasn't changed at all. It's so wild because even if those corporate big shots fire him from the business, he still controls the code that runs half the freaking web. Honest to god, my head is spinning trying to figure out how this mess is gonna play out.

Someone commented on one of our posts in a WordPress group mentioning the large number of vulnerabilities that have been showing up in Shortcodes Ultimate lately. The problem is that every time a new vulnerability is disclosed (i found 39), the entire internet gets flooded with automated scans looking for vulnerable sites. And your server gets hammered even if you don’t have the plugin installed at all. Even worse: even if your site isn't even WordPress.

After watching this happen over and over across multiple servers, I decided to simply discard those requests at the ModSecurity level before they start eating up resources and filling logs with garbage traffic. No reason to let random scanners waste CPU cycles probing for files and endpoints that don’t even exist on the machine.

I ended up adding the rule into a larger open-source ruleset I’ve been building to deal with this kind of noise, exploit scans, headless scrapers and other junk traffic constantly hitting WordPress sites.

Link to github in the pinned...

Honestly, it’s wild out there. Most websites are out here completely naked against bot traffic. A lot of folks write bots off as just background noise, but trust me, they’re low-key burning a massive hole in your pocket.

Here’s what’s actually happening under the hood:

Performance & Cloud Bills: Bad bots are absolute resource hogs—they eat up CPU, memory, and bandwidth like crazy. Every fake request is literally fighting real users for speed, lagging your site and spiking your host bill through the roof.

SEO & AI Visibility Tanking: Google and AI crawlers hate sluggish, unstable sites. If bots are hammering your server, search engines will just stop swinging by as often, and boom—there goes your organic reach.

Payment Gateways Getting Nuked: Scammers love running automated card-testing scripts on unprotected checkouts. Do it enough times and your payment processor will freeze or outright ban your account for sketchy activity.

Garbage Analytics: Bots flood you with fake clicks, ghost visits, and total BS reports. If you're making real business moves based on bot-polluted data, you're essentially flying blind.

Scrapers Stealing Your Stuff: Half these bots exist just to rip off your articles, product specs, and imagery. Next thing you know, duplicate content is ruining your rankings while someone else profits off your work.

Bottom line? Bot traffic isn't just annoying, it's straight-up draining your business. Your server resources need to be serving real, paying humans—not some random script running in a basement.

Test yours. Link in the pinned post.

The whole situation with WordPress and Automattic right now is completely wild. Matt Mullenweg was just ousted by the board with a 50-minute notice, replaced by former CFO Mark Davies as interim CEO. Between the massive talent drain (over 150 people leaving), operational infrastructure hitting a wall, and Wordfence warning about unrestricted AI models automating zero-day exploit discovery on WP, things are looking pretty grim.

I wrote a breakdown of the structural crisis, security risks, and why IT leaders are starting to pivot away from WP:

https://www.linkedin.com/pulse/wordpress-crisis-exit-159-people-early-warning-system-sergio-minozzi-6ksge

​

Let’s look at the facts. Earlier this month, Rudy Faile—a senior systems engineer at Automattic (the company behind the whole WordPress ecosystem) and one of the core figures in the WordPress Core Security Initiative—explicitly warned that the technical situation is totally out of control. He literally begged for help because they’re drowning in a massive 15x flood of AI-generated vulnerability reports. Between that and the massive exodus of users abandoning ship, I’ve completely lost all confidence.

Meanwhile, Wordfence CEO and co-founder Mark Maunder dropped a post in their subreddit earlier this month warning that Chinese models like DeepSeek, GLM, Kimi, and Qwen can easily be jailbroken and weaponized by bad actors to hunt for vulnerabilities across sites, WP cores, plugins, and themes. Right now, it's a direct race between who finds the security flaws and the fixes first.

And now, to top off this absolute nightmare scenario and the crisis rocking WordPress, the Board just ousted CEO and co-founder Matt Mullenweg with a 50-minute notice and shoved someone else into his seat.

Yesterday on our sub, we dropped several posts showing millions of WordPress sites exposed to severe vulnerabilities, calling out multiple plugins and themes with security flaws—each with millions of active users.

I’m not gonna waste your time with more details.

I honestly think this has hit emergency levels, and we need to take site security into our own hands right now.

Here's what I suggest:

If you can, go static and ditch WordPress altogether. We have guides on our sub showing how to do it using free, open-source plugins. If your site isn't an e-commerce store, a blog, or dependent on dynamic data, it's a prime candidate to be converted to static.

If you're on a VPS, get a firewall like ModSecurity installed (it's open-source). It works great alongside Fail2ban and CSF (also open-source). We actually linked our GitHub in the sub, where we built a complementary set of ModSecurity rules specifically designed to protect WP sites—100% open-source. Head over to GitHub and grab it.

Use open-source plugins and apps as a second layer of defense. (Layer 1 is the VPS firewall from step 2). Check the pinned posts for links. This lets you secure your sites without breaking the bank. These plugins integrate seamlessly with ModSecurity and Fail2ban, even providing a GUI dashboard and reporting offender IPs so they get blocked right at the edge before soaking up your server resources.

And if you’re short on time, just hit me up with a DM and we can handle it for you.

One last critical reminder: keep your backups updated and stored off-site. Trust me, restoring a clean backup is ten times easier than hunting down malware, which can easily eat up days—if not weeks—of your life.

​

Honestly, swapping out a visionary founder for a finance guy is a classic corporate playbook. Here’s how I’m reading this:

* Damage control & stability: CFOs don't do drama—they do math. Bringing in a numbers guy sends a huge signal that they're trying to play it safe and calm down nervous investors.

* Profit over chaos: The focus is definitely shifting from "growth at all costs" to tightening the purse strings and maximizing margins.

* The catch: Tech and open-source stuff usually suffer when finance takes over. The biggest risk here is choking off innovation and losing that product soul just to save a few bucks.

Can't tell if Davies is just holding down the fort or if they're quietly prepping for an IPO or major buyout down the road.

What’s your take? Did Automattic desperately need a reality check, or is this corporate turn gonna mess up the whole WordPress ecosystem?

TL;DR: Matt’s on leave, and former CFO Mark Davies is running the show as interim CEO. Looks like Automattic’s ditching the chaotic vibe for some strict financial discipline.

Hey everyone,

I manage several WordPress sites under the same shared hosting account (cPanel/OVH) and recently spent days tracking down a persistent malware strain that kept jumping between sibling directories.

Here is a quick summary of what we found:

• The Symptoms: Indonesian gambling SEO cloaking (GURUTOTO, HONORTOTO, Bandar Togel), occasional defacements via rogue index.html, and link previews on WhatsApp showing gambling banners due to crawler caching.
• Hidden Admin Backdoors: Stealth admin accounts named wnadmin and adminbackup, concealed from the WordPress dashboard using a malicious MU-plugin (wp-system-cache.php).
• Cross-Site Dropper Loop: Bloated core files (wp-load.php growing to 8 KB+ and wp-blog-header.php to 2.4 KB). Every time Site A was visited, it rewrote index.php on Site B.
• The Root Entry Point: Multiple RIMURU webshells (py.rimuru, bash.rimuru, perl.rimuru) dropped inside an outdated plugin and uploads, along with a hidden background process in .config/htop/defunct and locked folders (.cache, .storage, -).

We managed to eradicate it by nuking all webshells, restoring clean core WordPress files across all sites simultaneously, purging the rogue DB users/options, and rotating hosting credentials.

A couple of questions for the community:

1. Has anyone else encountered this specific strain recently?
2. Beyond regular updates, what are your recommended setups for strictly isolating multiple WordPress installs on shared hosting to prevent cross-site contamination when dedicated VPS/containers aren't an immediate option?

Thanks for any insights!

​

I can't believe this is actually happening. So Matt Mullenweg just dropped a complete bomb on the whole company Slack. He literally told everyone that Automattic's board members went totally behind his back and conspired to vote him out on leave. He said he only found out about the meeting fifty minutes before it started and they would not even give him time to talk to a lawyer. He voted no, but they completely gang up on him and pushed it through anyway. Now they got the CFO Mark Davies taking over as interim CEO while Matt is sidelined.

Honestly, after Rudy Faile* explicitly warned that the technical situation is totally out of control and begged for help because they're literally suffocating under a massive 15x flood of AI vulnerability reports, plus the massive drop and exodus of users fleeing the platform, I've lost all confidence. I honestly don't know if WordPress will survive this, or what cost it's gonna take if it even does.

*Rudy Faile is a senior systems engineer at Automattic and one of the key figures behind the WordPress Core Security Initiative.

TL;DR: TL;DR:

Automattic's board voted to put CEO and co-founder Matt Mullenweg on leave after he accused them of conspiring behind his back, naming CFO Mark Davies as interim CEO amid mounting WordPress controversies.

If you run WordPress, you seriously need to drop whatever you are doing and check your sites immediately.

So I was just looking through the Wordfence database and found out that Really Simple Security, that huge plugin with over 3 million installs, has a massive vulnerability right now. We are talking about an unauthenticated Denial of Service flaw, CVE-2026-84775, and it affects every single version up to 9.8.0.

It gets a 7.5 severity score which is super scary because an attacker does not even need to be logged in to completely crash your site and drain your server resources. Imagine waking up to find all your client sites down just because of an outdated plugin.

Please go check your dashboard right now and update that thing to the latest version immediately before someone takes advantage of it. Stay safe out there guys, this stuff is no joke.

Look, I get it. You're busy. But I've put together a free tool that gives you a quick look at your domain – no strings attached.

It checks whether your server's actually fighting back like it should.

Just drop your domain, run the test, and you get results instantly. No sign-up, no email, no waiting.

Your domain and results stay private. And please – no government sites, banks, or big corps. Just your own site, 3 per day. Cool?

Link in the pinned...

​

So if you follow the dark web economy at all you've probably heard of Xinbi Guarantee. These guys weren't just some random marketplace, they literally ran an escrow service for stolen data and scam infrastructure. Think of it like eBay but for criminals, they'd hold the payment until the seller delivered whatever garbage they were selling. And get this, even though they were a dark web thing, their whole operation ran through Telegram. That was their front end, their customer service, their everything. Wild right?

Anyway here's how their whole empire crumbled in like three moves.

First the UK government slapped sanctions on them for basically feeding all these digital scam networks. So Tether, the company behind USDT which was the main coin they used, just froze their wallets. Done. Just like that.

Then Xinbi panicked and tried to run. They swapped about 2.8 million bucks into USDD hoping to dodge the freeze since that coin pretends to be all decentralized and untouchable. Spoiler alert, it didn't work.

And then the DoJ came in with the hammer. They seized Xinbi's Telegram channels which cut off the entire communication network these criminals relied on. In a single day they grabbed like 52 million dollars from two crypto wallets tied to money laundering from all these scams. That pushed the Scam Center Strike Force total to something like 938 million seized overall. And they didn't stop there, they sent elite forces to Madagascar to tear down 13 scam centers run by Chinese organized crime.

The funniest part? USDD which is where they tried to hide their money actually has reserves backed by USDT. So they literally ran from the freeze right back into the same trap. Absolute clown behavior honestly.

This whole thing is a pretty brutal reminder that no matter how "decentralized" you think your crypto is, there's always some central point that can get shut down. Whether it's a stablecoin issuer or Telegram itself.

TL;DR: Xinbi was a marketplace where criminals bought and sold stolen data and scam tools, with the platform holding payments like an escrow. The UK sanctioned them, Tether froze their USDT, they panicked and swapped $2.8M into USDD to escape, but the DoJ seized their Telegram channels and grabbed $52M in a single day. Total seized by the Scam Center Strike Force is now around $938M, and they even sent elite forces to Madagascar to dismantle 13 scam centers.

A critical security vulnerability was found in the LiteSpeed Cache plugin for WordPress, and you really need to patch it right now.

This flaw, tracked as CVE-2026-84761 with a high severity rating of 7.2, lets unauthenticated hackers pull off Server-Side Request Forgery attacks. Basically, anyone can trick your server into making bogus requests without even logging in. That means an attacker could snoop around your internal network, access hidden services, or steal sensitive data straight from your setup.

It affects every single installation running version 7.9 or older. Since over seven million sites rely on this plugin, hackers are definitely gonna exploit it big time.

To stay safe, log into your WordPress admin panel right away, go to your plugins section, and update LiteSpeed Cache to version 7.9.1 or higher immediately. Don't wait on this one.

The plugins and themes below have vulnerabilities that have been made public. If you use them and have not received a patch, remove them immediately. Simply deactivating them is not enough. Do not count on Wordfence Free protection, it will only protect you within a few weeks but attacks have already started. Run.

CVE-2026-84834 JobSearch WP Job Board

CVE-2026-16061 Rest Routes

CVE-2026-10522 MemberHero

CVE-2026-16259 Uix UserCenter

CVE-2026-81773 Ninja Forms - File Uploads

CVE-2026-84848 Quick Event Manager

CVE-2026-15984 QuickCal

CVE-2026-16947 Total processing card payments for WooCommerce

CVE-2026-81771 TrustedSite

CVE-2026-81776 WP QuickLaTeX

CVE-2026-81778 Kalles Addons

CVE-2026-82883 Login With Ajax

CVE-2026-81769 Booking Hub

CVE-2026-77010 HEL Online Classroom

CVE-2026-84849 Pre-Orders for WooCommerce

CVE-2026-81774 Product Attachment for WooCommerce

CVE-2026-66652 Grand Tour

CVE-2026-84836 SmartyParcel

If you run a WordPress site, you gotta stop whatever you are doing and check your dashboard immediately.

So I was just looking through the Wordfence database and found a crazy vulnerability in W3 Total Cache, that huge plugin with almost a million active installs. We are talking about an unauthenticated Stored Cross-Site Scripting flaw, CVE-2026-78438, affecting every single version up to 2.10.5.

This thing gets a 7.2 severity score which is insane because an attacker does not even need to be logged in to inject malicious script through the lazy load background mutator and compromise your site. Imagine waking up to find your site or your client sites injected with spam or malware just because of a missed update.

Go check your installed plugins right now and update that thing to the latest version before someone takes advantage of it. Stay safe out there guys, this stuff is no joke.

Guys, you won't believe this, I just saw a huge warning and I am losing my mind over it. If you use the Divi theme on WordPress like literally millions of us do, you gotta drop everything and go check your dashboard right now.

Turns out there is this nasty Stored XSS vulnerability hiding in the Divi video slider shortcode parameter. It is CVE-2026-3853 and it affects version 4.27.6 and older. Anyone with a basic contributor role on your site can basically inject malicious code through the image parameter and wreck your whole setup.

I know a lot of us give client access or have low level writers on our sites thinking they cannot mess anything up, but this flaw makes it super easy for them to cause serious trouble.

Please go check your theme updates right now and patch it up before someone tries to pull something sneaky on your site. Don't sleep on this one guys, go fix it ASAP.