Category: Site Security
Malware, compromise cleanup, incident response, and the long-run data on how website abuse is shifting.
Yam Store Takedown: How Expired Domains Fuel Phishing
Microsoft disrupted Yam Store, a phishing marketplace tied to over a billion scam emails and texts that reused expired company…
Ghostscript CVE-2026-39919: Check WordPress PDF Uploads
A Ghostscript flaw lets crafted PDFs corrupt memory when servers make thumbnails. How to check whether your WordPress site renders…
Phishing Emails Now Hide Orders for Your AI Assistant
Phishing emails now hide invisible instructions for AI assistants that summarize mail. How hidden prompt injection works and 5 ways…
Fake AI Ad Tools Steal Ad Accounts: 5 Checks for Marketers
Fake ChatGPT, Gemini and Meta Muse ad tools use a fake Connect window and a live operator to steal ad-account…
WordPress 7.1.3: Pending Spam Comments Could Carry XSS
WordPress 7.1.3 fixes 7 flaws, including a stored XSS on the Comments screen exploitable via pending comments. Update now and…
Phishing Tripled in Microsoft’s 2026 Report: 5 Site Checks
Phishing was the way in for 23% of intrusions in Microsoft’s 2026 Digital Defense Report, up from 7%. What AI…
Cloudflare AI Bot Settings: Don’t Block Googlebot (2026)
Blocking AI Training bots in Cloudflare also blocks mixed-purpose crawlers like Googlebot. Here’s what changed on September 15 and how…
Gravity Forms CVE-2026-84434: Check Hidden Upload Fields
Gravity Forms 3.1.0.4 and older let anyone upload files through a hidden File Upload field (CVE-2026-84434, CVSS 9.8). Update to…
Visual Composer CVE-2026-12227: Are You on 45.16.1+?
Visual Composer 45.16.0 and older let unauthenticated attackers run files on your server (CVE-2026-12227). The fix shipped quietly in July.…
Elementor CVE-2026-62062: One Link Can Add an Admin
Elementor 4.3.0 and 4.3.1 let one clicked link create an admin account (CVE-2026-62062). Update to 4.3.2 and check for admins…
