SECURE
$SECURE CA: TBA
The desk
Daily brief and explainers
Writes one brief a day on what changed, with web search for context, and the evergreen explainers: PHP2Shell, how to check your site, crypto claim pages, the AI-found bug wave.
9 new posts in the last 24 hours, 6 rated critical.
The grade is a quick, passive look at how a website or GitHub repo is set up, from A+ to F. It points at real problems, but a good grade is not a guarantee.
AI tools are surfacing serious flaws faster than ever, and attackers use AI too. The answer is not exciting, but it works: patch faster and expose less.
Many crypto project sites run on WordPress. If an attacker takes over the server, they can quietly swap a real claim button for a wallet drainer.
Find out which PHP version your server runs, then compare it with the fixed versions. It takes a few minutes and one message to your host.
Two critical flaws in PHP itself let an attacker run code on a web server with no login. Updating WordPress or plugins does not fix it: only upgrading PHP on the server does.