9 articles
Every article tagged Incident Response, newest first. Search all articles
Security10 min read
cPGuard supply chain attack: check your server and WordPress sites
The cPGuard supply chain attack put root-level server credentials at risk through a malicious automatic update on November 2, 2026. Check your cPGuard update history first, even if you have already patched the server.
Security11 min read
DreamHost data breach: what to check on your WordPress site now
The DreamHost data breach exposed FTP/SFTP credentials and some webmail accounts, putting affected WordPress sites at risk of unauthorized changes. Start by checking DreamHost's reset notice and securing your file-access and email accounts.
Security12 min read
Ultra Addons for Contact Form 7 vulnerability: check, update and recover
The Ultra Addons for Contact Form 7 vulnerability (CVE-2026-102435) affects plugin versions 3.5.54 and earlier when PDF Generator is enabled and a form uses it. Version 3.5.55 fixes the flaw. Check your installed version and PDF Generator settings first, then update and look for signs of deleted files.
Security13 min read
WordPress 7.1.4 security release: exploited updater flaw and what to do now
The WordPress 7.1.4 security release fixes 22 vulnerabilities, including an updater flaw that needs no login and can lead to remote code execution. Wordfence recorded attack attempts, and on November 3, 2026, CISA added the flaw to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation.
Security11 min read
HTTP2Shell (CVE-2026-111497): WordPress and Next.js exposure
HTTP2Shell is CVE-2026-111497, a flaw in Google's Brotli decoder that can corrupt memory when software decompresses malicious data. Also called Node2Shell and Broccoli2Shell, it has fixes in Node.js 22.23.4, 24.22.1 and 26.12.1, plus Brotli 1.0.10, 1.1.1 and 1.2.1.
Security11 min read
PHP session upload progress vulnerability after the PHP2Shell patch
The PHP session upload progress vulnerability remains open after the PHP2Shell patch. On 23 October 2026, php.net warned about an unlikely remote code execution path tracked as CVE-2026-115560; the 21 October security releases still fix the two original PHP2Shell vulnerabilities.
Security14 min read
PHP critical security update: PHP2Shell leak and fixes
PHP released a PHP critical security update on Wednesday, October 21, 2026, for two vulnerabilities known as PHP2Shell that allow remote code execution without authentication. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Monitoring11 min read
Run a WordPress backup restore test and prove recovery works
A WordPress backup restore test should end with a working isolated copy, a timed recovery log, and a pass/fail record for the business tasks that matter. Restore a representative backup away from production, verify the files and database together, run defined checks, and record anything missing or unavailable.
Security12 min read
How to clean a hacked WordPress site and stop it happening again
To clean a hacked WordPress site, contain it and keep a copy of the compromised files and database, then find what changed and replace compromised code from trusted sources. Close the entry point, rotate credentials and salts, clear search warnings and watch for reinfection.