Why Website Reinfections Happen
Val Vesa I joined Sucuri a little over a month ago. My job is actually the Social Media Specialist, but we have this process where regardless of…
The Impacts of a Hacked Website
Tony Perez Today, with the proliferation of open-source technologies like WordPress, Joomla and other Content Management Systems (CMS) people around the world are able to quickly establish…
Understanding WordPress Plugin Vulnerabilities
Daniel Cid When WordPress vulnerabilities are disclosed in plugins, there are often many questions. Some are minor issues, some are more relevant, while others are what we’d…
Inverted WordPress Trojan
Denis Sinegubko A trojan (or trojan horse) is software that does (or pretends to be doing) something useful but also contains a secret malicious payload that inconspicuously…
Security Advisory: MainWP-Child WordPress Plugin
Mickael Nadeau During a routine audit of our Website Firewall (WAF), we found a critical vulnerability affecting the popular MainWP Child WordPress plugin. According to WordPress.org, it…
Why A Free Obfuscator Is Not Always Free.
Peter Gramantik We all love our code but some of us love it so much that we don’t want anyone else to read or understand it. When…
Malware Cleanup to Arbitrary File Upload in Gravity Forms
Rodrigo Escobar During our regular cleanup process we came across a reinfection case that caught our attention. This particular environment didn’t have anything special or fancy, it…
Why Websites Get Hacked
I spend a good amount of time engaging with website owners across a broad spectrum of businesses. Interestingly enough, unless I’m talking large enterprise, there…
Security Advisory – WP-Slimstat 3.9.5 and Lower
Marc-Alexandre Montpas WP-Slimstat users should update as soon as possible! During a routine audit for our WAF, we discovered a security bug that an attacker could, by…
Vulnerability Disclosures – A Note To Developers
This post is entirely for developers. Feel free to read, but approach it with that in mind. There is no such thing as bug-free code.…
Analysis of the Fancybox-For-WordPress Vulnerability
We were alerted last week of a malware outbreak affecting WordPress sites using version 3.0.2 and lower of the fancybox-for-wordpress plugin. As announced, here are some of the…