WordPress publishes usernames through five separate paths, most of them core behaviour. Each one tested against a live install, with the fix, the fleet audit, and what to do first instead.
Performance11 min read
An authenticated Author+ RCE via file upload on sites using Imagick and Ghostscript. Three checkable preconditions, the WP-CLI to answer each across a fleet, and what the CVE record does not yet say.
How To10 min read
A reported campaign impersonates AI crawlers to scan for credential and config files left by AI coding tools. Why user-agent rules are theatre, how to verify a crawler properly, and the commands to check your own fleet.
AI11 min read
Discovery got faster on both sides. Distribution of the fix did not. What AI actually changed about finding plugin bugs, what it did not, and the WP-CLI commands to measure your own exposure window.
AI11 min read
Wordfence shipped the ARVE backdoor rule to premium on 28 July. Free tier gets it 27 August. How to measure your own exposure window, verify the WAF is actually loaded, and four ways to close the gap.
Security12 min read
WAF, malware scanning, isolation, daily backups. Every host lists them and almost none of it is verifiable from the marketing page. Ten checks you can run yourself to find out which claims are real, and the questions worth asking before you buy.
Security9 min read
A hardcoded backdoor reached version 10.8.7 of a 20,000-install WordPress plugin via a compromised developer account. It was caught in under two hours and never distributed. What it did, why the detection matters more than the damage, and what it says about trusting the repo.
Security9 min read
Both wp2shell CVEs went into CISA's KEV catalog on 21 July and public exploits are circulating. Patching closed the door; it did not tell you whether anyone was already inside. A WP-CLI compromise-assessment runbook, and the line where cleanup stops and rebuild begins.
Security10 min read
Which of your sites were unpatched last Friday? A defensible auto-update policy, a WP-CLI fleet inventory you can query, verification that runs itself, and an emergency patch path for the next zero-day.
How To11 min read
Two chained WordPress core flaws give an anonymous attacker remote code execution on a default install. What CVE-2026-63030 and CVE-2026-60137 actually are, how to check your exposure with WP-CLI, and how to tell whether you were hit before you patched.
Security12 min read
Most WordPress hacks come down to a stolen password, and 2FA makes a stolen password useless on its own. What two-factor authentication is, which method to choose, how to set it up on WordPress, and how to handle recovery codes and team rollout.
Security11 min read
A large share of WordPress membership sites leak their paid content - not because the plugin is broken, but because the content lives in files, APIs, feeds, and caches the paywall never guards. The real leak paths, and how to audit your own site as a stranger.
Security11 min read
The all-in-one WordPress community stack
Also ours: wbcomdesigns.comvapvarun.combrndle.com
