Sucuri Malware Research Team
Browsing Category
WordPress Security
696 posts
Vulnerability & Patch Roundup — September 2026
If you operate a website, you’re already aware that a single unpatched vulnerability can render your site inaccessible, compromise your reputation, or necessitate extensive remediation…
SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor
Gabriel Barbosa Overview During recent website cleanup work, we analyzed a WordPress compromise where the same backdoor kept returning within seconds of every removal, no matter how…
WordPress Security Plugins: How to Choose the Right One
Sucuri In short, WordPress security plugins are tools you add to your site to strengthen your settings, scan for malware, watch for file changes, and block…
Vulnerability & Patch Roundup — August 2026
If you operate a website, you’re already aware that a single unpatched vulnerability can render your site inaccessible, compromise your reputation, or necessitate extensive remediation…
The Illusion of a Lock – How AI is changing the speed and scale of hands-on WordPress vulnerability research.
Luke Herbrandson 2026: the year the tools learned to hack In May 2026, OpenAI began testing an internal research model against a cybersecurity benchmark called ExploitGym. While…
How to Create a Secure WordPress Staging Site: Beginner’s Guide
Updating WordPress directly on a live website can cause avoidable problems. A plugin update might break checkout, or a theme change could create layout issues…
Vulnerability & Patch Roundup — July 2026
Running a website means a single unpatched vulnerability can take it offline, harm your reputation, or require cleanup. Most compromises begin with automated attacks exploiting…
Why Delaying WordPress Updates Increases Security Risks
WordPress updates help close known vulnerabilities before automated attacks can find and exploit them. Once a patch is released, attackers often move quickly to scan…
Vulnerability & Patch Roundup — June 2026
Running a website means a single unpatched vulnerability can take it offline, harm your reputation, or require cleanup. Most compromises begin with automated attacks exploiting…
WordPress PBN Plugin Drops Dual Webshells via Database Injection
Puja Srivastava During a recent incident response engagement, our team uncovered a multi-stage WordPress infection that goes beyond the usual file-based malware. The attacker combined a fake…
Vulnerability & Patch Roundup — May 2026
If you run a website, you know that a single unpatched vulnerability can take your site offline, damage your reputation, or leave you cleaning up…