Website Security News

Lack of controls when using WordPress’ update_option() with user input data equals plugin nightmare

John Castro

August 20, 2019

As mentioned in recent posts, WordPress’ update_option() function is used to update any option in the options database table. If the permission flow when using…

Read the Post

Sucuri Can Help Secure Your Client Websites

Stephen Johnston

August 19, 2019

At Sucuri, we understand that most web professionals and web agencies ultimately need to make their clients part of the decision-making process for choosing to…

Read the Post

What Hackers Do After Getting Access to a Website

What Hackers Do after Gaining Access to a Website

Pilar Garcia

August 15, 2019

A hack or cyber attack is the act of maliciously entering, taking control over, or manipulating by force a web application, server, or file that…

Read the Post

Skimmers and Phishing

Denis Sinegubko

August 14, 2019

Recently, we shared a post about a network of domains used in a JavaScript credit card stealing malware campaign. These domains are all hosted on…

Read the Post

How to Create a Website Maintenance Plan & Contract

Victor Santoyo

August 13, 2019

In my years of experience working alongside agencies, I’ve realized that managed providers and other web pros who offer website maintenance to their clients, have…

Read the Post

Our security analyst Christopher Morrow recently discovered a server-side Magento skimmer that was injected into the savePayment function in the app/code/core/Mage/Checkout/Model/Type/Onepage.php file. This code emails…

Read the Post

Troldesh Ransomware Dropper

Luke Leal

August 12, 2019

Over the past few weeks, we’ve seen an increase in Troldesh ransomware using compromised websites as intermediary malware distributors. The malware often uses a PHP…

Read the Post

Hydro-Quebec phishing

Luke Leal

August 7, 2019

We have found an interesting phishing kit containing numerous phishing pages which target large, popular brands like Amazon and Paypal. What was interesting about this…

Read the Post

Magento 2 PHP Skimmer Saves To Image File

Magento Skimmers: From Atob to Alibaba

Denis Sinegubko

August 7, 2019

Last year we saw a fairly massive Magento malware campaign that injected credit card stealing code similar to this: It uses the JavaScript atob function…

Read the Post

Autoloaded Server-Side Swiper

Denis Sinegubko

August 6, 2019

Front-end JavaScript-based credit card stealing malware has garnered a lot of attention within the security community. This makes sense, since the “swipers” can be easily…

Read the Post