$ grep -l "tag:web-security" writing/
tag: web security.
2 pieces tagged web security, newest first. The full taxonomy is on the tag index.
2026·07·18
wp2shell: WordPress core has an unauthenticated RCE. Patch now. wp2shell (CVE-2026-63030) is an unauthenticated remote code execution flaw in WordPress core — not a plugin — patched on 17 July in 6.9.5 and 7.0.2. No public exploit yet, but one is coming fast. Why a core flaw is different, and why you should patch every site now. wordpress · web security · patching
8 min
2026·07·11
Three weeks with the door open A cybercrime crew backdoored 25,000 websites using nothing but public exploits — then left its own server open on the internet for three weeks. The exposed working directory shows an adversary far less polished, and far more industrialised, than its victims imagined. threat intel · web security · craft
8 min
→ all tags · all writing