I updated this blog which ran an antiquated version of WordPress from the neolithic era. I used the opportunity to review all the files, all the permissions, everything. It was all squeaky clean. The minute I run a “new and secure” version this happens:
My mistake was updating from a tried and true version which had stood the test of time, to the latest and greatest which happened to be vulnerable to https://github.com/0xsha/wp2shell. Thankfully, the update came with containerization, which isolated it from whatever else my solar Pi is running. Maybe pointing to wordpress:latest wasn’t a good idea, but then again, this vulnerability has been around for a while so I was fucked no matter what. It’s kind of crazy to find something so blatant in WordPress core. WordPress is notorious for having vulnerable plugins, I had gotten to trust WordPress itself. No longer.
I’ve restricted routing rules to the blog, and added monitoring to detect admin users getting added.
Sorry you had to experience that. I just recently moved from wordpress to hugo (with the help of some LLM scripting to grab everything from the wordpress xml). It honestly feels great not to worry about some of the inherent weaknesses of the PHP web app, since I’m fine with simple posts. May be worth a try switching to static site? That also allows more efficient caching, which may be kinder to your infrasture 🙂
I can’t believe it’s the first I hear about Hugo, it looks pretty great. This might be too much of a feature degradation for me, I do like comments and an occasional dynamic thing, but it’s definitely giving me pause. Thank you for mentioning it :).