Comment by technion
8 hours ago
In nearly every org I've been in or contracted to, the public landing page of the company gets a special place outside of any ops of general technical team, and is instead the work of a marketing group or a "creative" outsourcer who will default to Wordpress on PHP.
Seems like most main company sites at places I've worked. If you are lucky, that WP instance is a fully managed service where they proactively deal with keeping it on the latest PHP, WordPress, and plug-in versions.
We run on SiteGround, and they had the patch up about an hour or so after it dropped and auto upgraded us.
My shit on Wolfi, managed by ChainGuard, a “security company”, didn’t have a patch live hours later.
The funny thing is, people running Wordpress have dealt with 0 day bullshit so often that it’s basically a Tuesday for them, not even a big deal. So hilariously Wordpress folks have plenty of options here simply because it’s been a nasty attack vector for so long and these people are so used to dealing with horrific vulns like this that patching it is actually pretty trivial
This rings extremely true. The good part about it is, unless there's some kind of exceptional factor (e.g. the app.companyname . com cookie using a cookie scoped unwisely to companyname . com), they can go right ahead and do that and while they might get the corpsite homepage pwned and redirected to penis-pill scam sites or something, any truly dangerous actor who gets a foothold there can't do jack shit in terms of actually compromising your valuable data, getting source code, stealing app sessions, etc because that server is not just outside the VPC, it's in a completely different cloud account somewhere far away.
I’ve been to a few places like this and managed to get rid of the Wordpress infestation.
This is how it began and should stay, when IT teams started to get involved in this they ran heavy overhead and aren't clued in on creative requirements. Stick to keeping emails and erp servers up.