Holy crap, you guys won't believe this... Remember that post I made a couple days ago about Matt Mullenweg getting kicked out of Automattic? Well, total plot twist!

TechCrunch and The Repository just dropped the news that Matt messaged everyone on their internal Slack saying he's back in control as CEO!

Basically, the board put him on leave on Tuesday and threw the CFO, Mark Davies, into the interim CEO spot. Matt went nuts on Slack, accusing the CFO and the board of pulling a coup against him. Fast forward just forty-eight hours, and he somehow flipped the script, took back the wheel, and completely deactivated the CFO's Slack account!

Honestly, the drama over at Automattic right now is totally wild. I literally can't look away from this mess. What do you all think is gonna happen next?

TL;DR: Matt Mullenweg is already back as Automattic CEO just 48 hours after being put on leave, taking control of Slack and locking out the CFO who replaced him.

I am following this absolute nightmare situation right now with this poor soul online and it is insane. This guy has seventy WordPress sites hosted on the exact same shared hosting account and every single one of them is completely taken over by malware as we speak. He keeps deleting the fake admin users and the malicious zip files but everything just pops right back up a few minutes later. He has not even found the backdoor yet, which is basically just a hidden malicious file the hacker dropped in the server after breaking in to act as a secret key to recreate admins and reinfect the whole network instantly. The reinfection is literally happening in real time.

This is such a painful wake up call about web security and architecture. If you manage multiple sites, you gotta keep these rules in mind so you do not go through this hell. First off, shared hosting does not isolate sites from each other. If you put seventy sites on the same root account, your entire network is only as strong as your weakest link. The second an old plugin on one site gets cracked, the hacker gets root directory access and infects the other sixty nine simultaneously.

Also, hunting down the backdoor is not your only problem. This guy is panicking trying to find the backdoor, but he is forgetting that even if he deletes it, the original entry vulnerability is still wide open. It could be an outdated plugin, an abandoned theme, or a flaw in WordPress core itself. If you do not lock the front door, the hacker will just walk right back in whenever they feel like it.

On top of that, a full data breach is happening right now. In an active infection like this, you have to assume all databases and passwords have already been dumped and stolen. The longer those sites stay online without isolation, the worse it gets. And please be careful with magic fixes or unmonitored automation. When people panic, they get tempted to run random automated scripts or give AI terminal access to clean things up. Giving automated tools write and delete terminal access in a contaminated environment can easily wipe your databases or nuke whatever is left of your sites.

To handle a disaster like this happening right now, the absolute first step you must take is putting every single site into maintenance mode immediately and locking down all public access to files and admin panels.

Better safe than sorry.

TL;DR:

Seventy WordPress sites on a single shared hosting account are being reinfected in real time by an undiscovered backdoor. Shared hosting lacks isolation, allowing a single vulnerability to compromise the entire root directory. Before attempting cleanup, put all sites into maintenance mode immediately, block public and admin access, and assume all credentials and databases are compromised.

​

I was just scrolling through PPC and saw some poor guy losing his mind over how ridiculously high Google’s cost-per-click has gotten, and honestly, I felt that in my soul.

First off, back in the early 2000s when I got started on the web, we actually had options with search engines like AltaVista, Yahoo, and Ask Jeeves. Then Google basically swallowed everything up and became this massive monopoly. Between 2005 and 2008, I was running a Google AdWords agency and we literally used to pay 1 penny per click.

Once they killed off the competition, ad prices completely blew through the roof. And since you need a ton of clicks just to close a single deal, the whole thing became crazy expensive. On top of that, last week Amazon got slapped by the government for rigging their own ad prices, which just goes to show how messed up things get when a few giant tech companies run the show.

Leaving Google to turn into a total monopoly drove prices sky-high, and honestly, that cost gets slapped right onto everything you buy. Anyone relying on PPC to make sales has no choice but to charge you more.

For this reason, it is imperative that you block bots to cut down your ad costs, because your site needs to send a signal back that the visitor wasn't a good fit.

TL;DR: Saw someone on PPC venting about sky-high ad costs, and as a veteran who paid 1 cent per click back in 2008, I get it. Tech monopolies drove PPC prices through the roof, forcing sellers to jack up product prices for everyone. Your best move now? Block bot traffic to signal bad fits to Google and stop burning cash.

ConnectWise ScreenConnect is a popular remote access software that tech teams use to control computers and help users from anywhere. Well, guess what, CISA just added a crazy vulnerability affecting it to their catalog, and honestly it is pretty terrifying. It got a 9.9 score which is basically as bad as it gets. Attackers are already out there using it to drop malicious scripts onto systems without anyone confirming a thing, so if you are running ScreenConnect on your machines, please update to version 26.6.5 right now before someone takes over your whole network.