Comment by joshuat
1 day ago
So a few million WordPress sites are just going to be overnight targets.
Although I guess that's not a dramatic change in the status quo.
1 day ago
So a few million WordPress sites are just going to be overnight targets.
Although I guess that's not a dramatic change in the status quo.
It's not. I maintain some WP sites, including one that is so custom that it can't be run on a service like WPEngine. I just assume it will be hacked on a regular basis.
Large swaths of the filesystem are chattr +i'd, non-writeable by the user PHP runs as. I have capabilities and network rules applied so that that context can't communicate outbound on the network. I have a WAF that restricts outbound traffic (normal users never download something as big as even 1 megabyte). I have a set of firewall rules to tarpit any automated scans that come near the site.
Nowadays, I run an AI agent continuously that scans the VM everything is hidden in for any signs of an intrusion, plus the host that contains the VM as well. I make sure that agent is sandboxed as well. (This only costs a few dollars a day in tokens which I bill to the customer.)
After this next world-wide intrusion, I may finally be able to convince the client they need to get off the WordPress e-commerce site that they got a teenage girl to do for free a decade ago.