Sucuri guide explains phishing aimed at website owners
A lookalike host login can relay a password and authenticator code into a live session; a compromised site may then host phishing pages.
18
- Mentions · 7d0
- Mentions · 30d5
- All mentions13
- First seenAug 15, 2026
- Last mentioned7d ago
Timeline
13 articles · newest firstPHP RCE flaws CVE-2026-109618 and CVE-2026-109619 exploited in the wild
Fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 7.4, 8.0 and 8.1 get emergency source backports only.
90
HTTP 401 means the server rejected unproven credentials
Sucuri covers WordPress, server, and API causes, and when a sudden wave of 401s can indicate compromise.
18
500 Internal Server Error: What It Means and How to Fix It
Sucuri explains common causes of HTTP 500 errors, including bad plugins, .htaccess, PHP limits, and hacked-site symptoms.
8
What Is Encryption? How It Protects Your Website and Its Data
Sucuri explains website encryption, how TLS combines AES with public-key cryptography, and what encryption does not stop.
16
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
Sucuri details SC, a self-healing WordPress backdoor that rebuilds from files, the database, and RAM.
60
WordPress Malware Comes Back After Removal Using a Self-Healing Backdoor
Sucuri documented SC, a WordPress backdoor that restores itself from files, the database, memory, and Ethereum-based commands.
56
SC WordPress Malware Rebuilds Itself After Removal Using Database and Memory Persistence
SC WordPress malware rebuilds deleted backdoors from files, the database, cron, and shared memory.
63
Vulnerability & Patch Roundup — September 2026
Sucuri's September 2026 roundup covers WordPress plugin patches including unauthenticated DoS in WooCommerce and arbitrary shortcode execution in WPForms.
45
SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor
Sucuri documents SC, a self-healing WordPress malware mesh persisting across files, database, and shared memory, regenerating within seconds of cleanup.
48
Vulnerability & Patch Roundup — August 2026
Sucuri's monthly roundup compiles August 2026 security patches for the WordPress ecosystem to help site owners prioritize updates against automated exploitation.
14
What Is a Website Attack Surface? A Beginner’s Guide to Reducing Risk
Sucuri's beginner guide explains how logins, plugins, APIs, and forgotten backups expand a website's attack surface and how to reduce that risk.
15
The Illusion of a Lock – How AI is changing the speed and scale of hands-on WordPress vulnerability research.
Sucuri examines AI's impact on WordPress vulnerability research, citing OpenAI's ExploitGym agents escaping benchmark confinement via an internal Artifactory cache.
48
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-57777<1%7.6Blind SQL Injection in Automattic WooCommerce (WordPress)
- CVE-2026-15812%7.5The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to…
- CVE-2026-48888<1%7.5Unauthenticated resource-exhaustion DoS in WooCommerce before 11.1.0
- The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on…
- The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the…
- The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110
- The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due…
- CVE-2026-77783<1%3.7The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing…
- CVE-2026-77784<1%2.7The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing…
Appears with
- WordPressproduct · 6
- Sucurivendor · 4
- SCmalware · 3
- UpdraftPlusorganization · 1
- All-in-One WP Migrationorganization · 1
- Apache HTTP Serverproduct · 1
- WatchTowrorganization · 1
- Artifactoryproduct · 1
- WordPressorganization · 1
- Previdianorganization · 1
- WPFormsorganization · 1
- LiteSpeed Cacheorganization · 1
- wpForo Forumproduct · 1
- PHPvendor · 1
- WooCommerceorganization · 1
- Cloudflareorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.