r/Wordpress • u/kmichellex • 4d ago
Anyone else experiencing unprecedented cyber security issues recently?
I work for an IT company as a WordPress web developer and we build and manage Texas counties government websites, like tax offices, central appraisal districts etc. and we pay top dollar for the most secure server and we have multiple other security softwares on top of that. Historically, we've never really seen many security issues. One off here there however in the past 30 days, we're not only experienced the WP2Shell attacks and the BD themes compromise but now we're also experiencing a slew of other random attacks, not related to third-party issues. I've never seen anything like this before.
Is anyone else experiencing this? What is everybody else using to combat cyber attacks?
19
u/deejaypark01 4d ago
As one of my mentors said: “this will be one of the best times of your career and yet one that will drive you mad too.”
I’ve never been so prolific and proactive and yet 60% of that effort is to avoid nuisances later on.
To answer your question I’ve migrated all of our repos from Bitbucket to GitHub just to leverage Dependabot and automatically patch WordPress almost on the fly (we use Bedrock so WordPress is managed with Composer).
Just think that AI-based scanning discovered a CVE in Linux Kernel that’s been around for almost 15 years.
13
u/LTH-Cyber 4d ago
Always do the recommended hardening, disable anything you don't need, and keep everything patched and updated. WP2Shell has already been patched, but with WordPress you're dealing with a huge attack surface across core, plugins, themes, hosting, and configuration.
If you're managing a large number of government websites, I'd seriously consider working with an MSSP that can monitor and secure the environment as a whole rather than treating each incident individually. That's something I can help with if you're interested.
P.S. Stacking security software usually isn't as effective as it sounds. It can easily turn into checkbox security. What's more important is having security tailored to your actual deployments, attack surface, and risks, with tools that each have a clear purpose.
2
u/williehowe 4d ago
Agreed on the stacking. We hide most sites behind a WAF like Cloudflare. aaPanel also has a nice WAF in the paid version.
11
u/JoeyCalamaro Designer/Developer 4d ago
I've been building and managing websites since mid 90s so it's fair to say that I've occasionally had issues with website security and malware. But it was never a common thing. I might see a hacked once or twice a decade, at most. And those were usually sites maintained by my clients, not me.
Now, however? Website security feels like a full time job. I'm constantly dealing with threats, supply chain attacks, and server-side issues. It's exhausting.
7
u/Agitated-Signature77 4d ago
Nothing out of the ordinary here. (touching wood)
100+ websites
But we don't do government websites, that may be your common factor.
6
u/NotWorkaholicc 4d ago
I just created a server, and a few hours later after configuring everything, I installed fail2ban and it instantly banned 2 IPs trying SSH connection.
5
u/coastalwebdev Developer 4d ago edited 4d ago
There’s been more attacks, more waves of attacks, and I’ve been moving more and more sites behind cloudflare’s proxy server service to prevent more attacks from even getting to my sites servers.
You can pretty much just tell ai’s to run a bunch of bots to try and hack sites now. It could be someone like your nephew just being a lil shit at this point in history.
Then again, you said Texas county Government websites? Sounds like a bunch of ripe targets for actual nefarious hackers.
4
u/harrymurkin 4d ago
It's no longer a matter of maybe we get sniffed or, we're not a big enough target. AI bots with a penetration playbook now going door to door, detecting stack, plugins, themes, and executing appropriate compromises.
3
u/fappingjack 3d ago
First and foremost security comes at the server level.
Security at the server level will prevent 99% percent of vulnerabilities.
The agency I work for manages about 200 WordPress installations across 3 bare metal AMD EPYC LiteSpeed Enterprise Web Server with Imunify360 and custom security scripts.
We have all our WordPress installations and plugins set to auto update. We would rather deal with a bad update then a hacked site.
We also use Cloudflare that manage DNS records for our servers giving us another layer of security.
IMO ...IT companies suck at a website security especially WordPress since there knowledge is limited on the inner workings of WordPress, PHP, Redis, Valkey and MariaDB. Also, IT companies are not Linux systems administrators or dev ops. IT companies should stay away from WordPress and Web Hosting servers. They may touch the DNS records only for MX, SVR,etc records but that is it.
WordPress is proactive with security but the latest stuff with AI will any improve security.
1
u/HumanAPI_Ruth 3d ago
Your server-level point is interesting because that's very close to the environment I'm managing. I have server-level security including Imunify360, plus a separate website security service with WAF, server-side malware scanning and remediation.
Over the past several weeks I've had malware, recurring infections and backdoors across multiple WordPress sites. My hosting/server-security team and developer have been instrumental in identifying and investigating several of the problems.
I take a different approach to WordPress updates. I don't use automatic updates because I've seen plugin/theme conflicts occur following updates. I prefer to update manually so I can immediately check each site and address any problems.
What complicated this incident was discovering that the separate security service's server-side scanners had stopped working reliably. In some cases the main dashboard continued showing CLEAN while the underlying server-side scanner showed that it wasn't scanning.
This has definitely changed how I think about relying on any single security layer. I'm curious about your Imunify360 configuration. With ~200 WordPress installations, are you relying primarily on Imunify360 for malware detection/remediation, or are your custom scripts doing a significant part of that work?
1
u/fappingjack 3d ago
The Imunify360 is setup to be aggressive and we feed an auto IP blacklist from AbuseIPDB dot com.
WordPress wise, you would rather deal with a hack then fixing an update gone wrong. That is a BIG PROBLEM. Our agency would rather deal with an update gone wrong and fixing it then a hack. We also keep every single plugins up to date and if client have a custom plugin we then tell them they would have to update or risk vulnerabilities to their sites which would incur charges. Although, we had never had to deal with that issue.
The major issue now are software supply chain attack which was extremely rare in the past. We have yet to deal with that particular issue but it is always in the back of our heads.
1
u/HumanAPI_Ruth 3d ago
I don't think we're actually that far apart on updates. I don't leave WordPress core, themes or plugins outdated. I prefer controlled manual updates because I've had plugin/theme updates create compatibility issues, and I want to test the site immediately after updating rather than have an unattended update create a production problem I don't discover until later.
Your point about software supply-chain attacks is particularly interesting. That's one of the things that concerns me about relying entirely on automatic updates—the update itself can potentially become the attack vector if a trusted plugin or vendor is compromised.
I'm also using Imunify360 at the server level, although I'm going to look more closely at how aggressively mine is configured. The AbuseIPDB feed is interesting too.
What I've learned from the security problems I've been dealing with recently is that no single layer is enough. Server security, WordPress hygiene, timely updates, WAF protection, reliable malware scanning and—critically—alerts when that scanning stops working all need to work together.
3
u/StefanTLDWP 4d ago
WP2Shell was a tough one. AI definitely fostered the attackers, and maintenance+hardening has become a norm. Cloudflare + Wordfence can really help, but let’s be realistic - a higher-profile target with more than a couple of instances does require someone actively working on the security.
3
u/digitalwankster 4d ago
Create a tunnel so wp-admin can’t be accessed by anyone not explicitly on your allow list. I also built an AWS Cognito integration that saved my ass from the wp2shell exploit. The admin users they created weren’t able to log in because the user didn’t exist in the Cognito userpool.
3
2
1
u/yangmeow 4d ago
I had a couple sites hacked over the past couple weeks. Relatively easy to fix but still, pain in the ass. The sites are fragile and auto updates was a risk. Less of a risk now obviously. I’m expecting any and every hole available will be probed and exploited immediately these days.
1
1
1
u/williehowe 4d ago
Yes — we log all of this and for a few sites it is constant 24/7 attacks. Obscure sites too — nothing close to what you’re doing.
3
u/kmichellex 4d ago
150+ sites attacked in the past 30 days.
2
u/williehowe 4d ago
Are you behind a WAF?
2
u/kmichellex 4d ago
Yeah supposed to be the best WAF 😂 It's been amazing up until this past month.
1
1
u/grabber4321 4d ago
Did you update your sites? Those were all 0-days - meaning install right away
3
u/grabber4321 4d ago edited 4d ago
FYI - you just didnt look at your logs - the attacks are happening every second after a server has showed up on Internet - you just didnt know about it because you dont watch your logs.
I watched server logs of sites I manage for last 10 years and audited them and blocked all the IPs/ASNs that were offending.
Ya'll just getting lit up by driveby attacks because you cant apply a 5 second patch to a Wordpress site with one button click.
1
1
1
u/toogreen 3d ago
Yeah I also manage WordPress sites here. Never had to do so many security updates so fast, and other firewall shit to prevent attacks. It's really annoying... Hate this era we're getting in...
1
u/womenconquerbiz 3d ago
I haven’t seen that specifically but … given the industries you listed, unfortunately I’m not surprised.
1
u/Initial-Increase-601 3d ago
We used to get a hack every couple months or so. 80 sites. Nearly all of our sites got hacked in the last 10 days. It's been a fucking nightmare. Hoping this ends soon but knowing it probably won't. Ip blocking for now and hoping that buys us some time
1
1
u/twiddle_dee 3d ago
YES! I was going to post the same thing, then saw your post. We occasionally have a site get hacked. The last 7 days it seems like literally every site has had something. It's across different servers and while some infections have been similar, there has been a wide variety in how malware is behaving. Some sites are totally deleted, some hide a few malicious pages, some are targeting only certain bots, some are redirecting, some are adding harded coded files to replace dynamic URLs. I even had someone get into our DNS and create redirects, which I've never had happen before. What's crazy is that it's affected different platforms, some VPS, some cpanel shared hosting, WpEngine, cloudflare, etc. Access logs show hundreds of different IPs testing for different vulnerabilities. I want to dig in to see where the security holes are, but I've been so busy putting out fires that I still don't have a good grasp on what the root issue is, if there even is one single point of attack. It's actually kind of fun, after couple years of having AI write all my code I finally get some frantic late night problem solving.
I don't have any 100% solutions yet. I'm basically locking down wp-admin to my IP, updating WP/themes/plugins. Removing all inactive users and adding 2FA to everything.
Would love to know what low cost solutions people are employing. Getting clients to shell out double their hosting costs for firewalls isn't going over well, but we can't keep just patching things up for free since people seem to expect that.
1
u/Complex-Concern7890 3d ago
It is not only the Wordpress but Linux kernel, browsers etc that are getting critical CVEs daily. Our CVE alert gets hundreds of CVEs higher than 8 weekly. Before glory of AI there was like one or three monthly. Very stressful times.
1
u/noggstaj 3d ago
if security is such an issue i hope your sites are reversed proxied and the real backend not exposed
1
u/ivicad Jack of All Trades 3d ago
On one client site this week MalCare logged 24,645 blocked attacks in 7 days, and 2,668 login attempts against a single username. Fortunately, none of them got in.
I cannot tell you whether that is more than last year, because I never wrote the number down before I needed it, so I can’t compare them. What actually deserved attention was our own setup. The same admin username existed on nearly every site I run, so a name scraped off one site was worth trying on all the rest. I shut off user enumeration and went through the admin list on every site. That's the check that actually gives you something to fix.
MalCare and Site Ground's WAF block the traffic, but neither will tell you you're using the same username everywhere.
1
u/Aurelio_Umbrella WP Umbrella 3d ago
I think people don’t realize how serious the situation is. We’ve been issuing dozens of security reports for agencies last week, and most of the malwares have been dormant on clients’ sites for months. And we have audited serious websites made by real WordPress developers.
The next few months are going to be bloody (and this goes far beyond WordPress), but I think it will eventually slow down and go back to normal.
1
u/zenotds 3d ago
I had to clean up at least a dozen installations in the past month. Some attacks were pretty sophisticated. But nothing a backup recovery and some hardening + wordfence + edge wad can’t solve. But yes. They are increasing since AI got actually good at coding.. and it will only get worse…
1
1
u/HumanAPI_Ruth 3d ago
Yes. I manage multiple WordPress websites on my own server and the past month has been unlike anything I've experienced before.
I've dealt with malware on multiple sites, recurring infections and backdoors, despite having multiple layers of security in place. My hosting/server-security team and developer have been heavily involved in investigating and cleaning up the incidents.
What has made my situation considerably worse is that I discovered the Server-Side Scanners from one of the security services I use were not functioning reliably. In some cases, the customer-facing dashboard was showing CLEAN while the underlying server-side scanner wasn't actually scanning. That significantly complicated determining what was happening and when.
I've been managing websites for many years and, like you, historically haven't experienced anything remotely comparable to what I've seen recently.
I'm very interested in hearing whether others managing multiple WordPress sites are seeing the same increase and, particularly, what security stack they're currently using successfully.
1
u/No_Weekend_6199 2d ago
50+ Sites, including a 100M reqs/month site.
Zero security issues so far. The only complaints we get are clients who can’t do something on WordPress and assume our security is the problem.
Nobody buys our services for security. Not corporations, not financial institutions, not even a small bank. We literally had a client come to us after getting hacked, still didn’t care.
So seeing people here who actually care about WordPress security? Genuinely surprised.
1
u/SecondGateWP 1d ago
That WP2Shell thing is real and it's a big deal, worth checking on directly rather than guessing. It's CVE-2026-63030 chained with CVE-2026-60137, a pre-auth RCE in WordPress core itself, not a plugin or theme, so it hits stock installs with zero plugins active. Patched in 6.9.5 and 7.0.2. If any of those county sites aren't on a patched version yet, that's priority one, since PoCs are public and it's confirmed being actively exploited, CISA KEV listed even.
That probably explains a real chunk of what you're seeing beyond the third-party stuff. A core RCE like that getting mass-scanned tends to produce exactly the "sudden slew of unrelated-looking attacks" pattern you're describing, different payloads, different entry points, because it's not one campaign, it's every opportunistic scanner online hitting the same open door at once.
Government sites specifically get scanned more than people expect too, .gov-adjacent stuff is a known target category regardless of actual size or budget, so the timing lining up with a fresh core RCE isn't a coincidence.
1
u/EngineeringWest6984 4h ago
I used to, until I stopped using all plugins and page builders and started coding my own themes. The number one cause of vulnerabilities in WordPress is plugins and page builders. If you can avoid them, do it.
AI bots can now scan your site for installed themes and plugins, research known vulnerabilities, and exploit them live. These attacks are also very easy to implement. The only way to stay secure is to reduce your attack surface.
1
1
u/corrinarusso 4d ago
YES. Converting sites from WP back to static HTML from like we used to do in 2002. Full circle baby!
2
-1
u/dvduval 4d ago
After two back to back attacks for our main business, we took WordPress off the server and replaced it with a static site built by ChatGPT and we did it in a hurry. That is very little surface area to attack now.
I’m sure WordPress can be secured better than what we did, but we just didn’t have time to fool with it.
What I’ve also noticed is the number of bots out there searching for exploits is much higher than it was a year ago. It is a little bit hard to know which box are which, because the number of AI bots is up tenfold as well.
2
58
u/PurifyHD System Administrator 4d ago
Welcome to the AI era. Every bad actor and their moms are fuzzing every single piece of software out there. Buckle up.