Passionate about website security and bringing truly affordable, effective website security to everyone!
Everywhere
Joined September 2009
- Tweets1.3K
- Following1.5K
- Followers864
- Likes1.3K
1/ On Monday I said the real risk in AI-built apps is boring: shipping with no security gate. Here's the worst one I found this week.
4/ The catch: a code scanner doesn't flag this. The code is valid. It just trusts the wrong source. It took a reasoning pass to find it.
Everyone fears AI writing malware. The real risk is more boring: it ships an unauthenticated route to your production DB and calls it done. Looks finished. Runs fine. Wide open. What's the 1st thing you check in AI-generated code?
Check out my latest article: AI Built It, AI Will Break It linkedin.com/pulse/ai-built-… via @LinkedIn
I kept hearing about how "everyone" is using Fail2ban and/or Imunify360 to block attacks on xmlrpc.php and wp-login.php on their WordPress sites.
Here's the truth.
wewatchyourwebsite.com/92-of…
Since we've been actively sending abuse reports, we thought this might be interesting to those in the hosting space.
wewatchyourwebsite.com/the-h…
Check out my latest article: When Security Plugins Aren't Enough: What 111,354 Infected Websites Taught Us About Modern WordPress Attacks linkedin.com/pulse/when-secu… via @LinkedIn
I know some who believe info stealers aren't real, but...
techradar.com/pro/security/c…
Thomas J. Raef retweeted
A few weeks ago, court documents revealed that Meta/Facebook was siphoning user data for competitive intelligence.
Even their top security engineer said that it was uncool.
Remember, if you use a free service (or a service pays you to use it), then YOU are the product.
When you rely on a VPN for your online security, the last thing you want is for your data to be exploited for competitive analysis. It's crucial to choose your VPNs wisely. In today's video, I explain what happened and which VPNs are my primary choice.
youtu.be/9E4V1-UochE
Thomas J. Raef retweeted
The @bricksbuilderio team has absolutely knocked it out of the park with these security features.
I could not have thought of a better "comeback" after the patched vulnerability.
WP Vendors take note, that's how it's done.
bricksbuilder.io/release/bri…
Thomas J. Raef retweeted
Handled another site that got hacked today, but this one was a bit more sneaky than ususal, so I enlisted the help of @WeWatch it's been properly taken care off.
10/10 would recommend.
Booked Thomas to be on my @Within_WP podcast as well, btw. Should be a good one!
Thomas J. Raef retweeted
Attention!
Update your Bricks sites immediately!
**Drop everything** what you do and update your sites.
I want to highlight that the Bricks team has been exceptional in their cooperation in getting this fixed as per our recommendations.
POC in 24h.
snicco.io/vulnerability-disc…
cybernews.com/security/cyber…
Good read for people who still don't believe session cookie theft is a "thing". But what do I know? I've been called a charlatan. LOL
"Infostealers, for a very long time, have used cookie theft as a way to get access to accounts,”
If you haven't already, take some time and check this out.
I had an awesome conversation with @westguard about how to prevent SPAM from your contact forms earlier today.
I swear I learned more about the topic in this call than I have in the last 5 years!
Full explainer, recommendations and the video replay here: theadminbar.com/effective-sp…
Thomas J. Raef retweeted
I had an awesome conversation with @westguard about how to prevent SPAM from your contact forms earlier today.
I swear I learned more about the topic in this call than I have in the last 5 years!
Full explainer, recommendations and the video replay here: theadminbar.com/effective-sp…