Tips for New Remote Workers
Juliana Lewis With the new pandemic hovering over our heads, the main piece of advice from most countries is stay home. Working remotely is a new reality…
Extract Function Backdoor Variant
Luke Leal We recently found malware on a client’s WordPress site that was using a variant of a backdoor that we previously covered back in 2014. The…
Reflected XSS in Advanced Ads Admin Dashboard
Antony Garand A patch for a vulnerability in the Advanced Ads plugin has been released. Prior to version 1.17.4, attackers were able to exploit two reflected XSS…
2020 Website Security Glossary
Art Martori As the online threat landscape continues to evolve, so too does the language we use to describe it. To support a safer internet for everyone,…
Innocent Defacement
Cesar Anjos When we talk about defacements, we’re usually referring to attacks leading to a visual takeover of a website’s page ― consider it a form of…
Throwback Threat Thursday: WordPress 4.7 WP-JSON Content Injection Vulnerability
Justin Channell Throwback Threat Thursday is a series of posts where we recall older vulnerabilities that have since been patched by their developers. In the past, these…
WordPress Database Brute Force and Backdoors
Denis Sinegubko We regularly talk about brute force attacks on WordPress sites and explain why WordPress credentials should always be unique, complex, and hard to guess. However,…
3-D Secure SMS-OTP Phishing
One of our remediation analysts Eli Trevino recently discovered a phishing page informing victims about fake Netflix service disruptions, supposedly due to problems with the…
Phishing and Malware via SMS Text Message
Krasimir Konov We’ve recently noticed an increase in reports of phishing and malware being distributed via SMS text messages. During one investigation, we identified fake messages sent…
PCI Compliance, Penetration Testing, and the Sucuri WAF
Marc Kranat Our support team is often asked, “Can we test our site through the Sucuri Web Application Firewall?” The answer is always yes, with a caveat.…
Let’s Encrypt Revokes 3 Million Certificates Due to CAA Bug
Northon Torga Imagine receiving a TLS warning on your browser every time you visit your website for 60 days straight. Definitely not an ideal situation and you…