Celise Davison
Browsing Category
Security Advisory
256 posts
Vulnerability & Patch Roundup — June 2026
Sucuri Malware Research Team Running a website means a single unpatched vulnerability can take it offline, harm your reputation, or require cleanup. Most compromises begin with automated attacks exploiting…
WordPress PBN Plugin Drops Dual Webshells via Database Injection
Puja Srivastava During a recent incident response engagement, our team uncovered a multi-stage WordPress infection that goes beyond the usual file-based malware. The attacker combined a fake…
Vulnerability & Patch Roundup — May 2026
If you run a website, you know that a single unpatched vulnerability can take your site offline, damage your reputation, or leave you cleaning up…
Vulnerability & Patch Roundup — April 2026
Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes…
Joomla SEO Spam Injector: Obfuscated PHP Backdoor Hijacking Site Visitors
Overview During a recent malware cleanup investigation, we encountered a compromised Joomla website where the site owner reported a strange issue. Their website displayed a…
Vulnerability & Patch Roundup — March 2026
Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes…
Vulnerability & Patch Roundup — February 2026
Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes…
Vulnerability & Patch Roundup — January 2026
Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes…
Shadow Directories: A Unique Method to Hijack WordPress Permalinks
Last month, while working on a WordPress cleanup case, a customer reached out with a strange complaint: their website looked completely normal to them and…
Malware Intercepts Googlebot via IP-Verified Conditional Logic
Some attackers are increasingly moving away from simple redirects in favor of more “selective” methods of payload delivery. This approach filters out regular human visitors,…
Fake Browser Updates Targeting WordPress Administrators via Malicious Plugin
We recently investigated a case involving a WordPress website where a customer reported persistent fake pop-up notifications appearing on their site. The warnings were urging…