I’ve Been Hacked

I am doing IT security for a long time. Backups, updates, patches, whatever needs to be done. I am also doing monitoring and that saved my butt.

My morning started after breakfast with a nice cup of coffee browsing through my emails. One got my immediate attention:

Verify database on webserver.

What? A script monitoring the database had detected some additions. The relaxed morning ended quite rapidly. I dumped the database and yes, two more admins had been added. Great. This WordPress installation had been compromised.

I mounted a backup disk and ran a script comparing the files on the backup and in the live installation. What I found confirmed what I already suspected. The attacker installed:

admin-utils-64f32ed287.php
direct.php
loot.php

which allowed him to access pretty much everything on the server under the UID of the webserver. Crap. I stopped access to the server, secured the compromised WordPress and synced with the backup to remove malicious files, than updated the wordpress installation (more about that in a minute). Finally I replaced the database with a “last known good”, changed the passwords, rotated the salts and terminated all possible current authorized connections. So far, so good.

Let’s see what happened:

I checked the logs and found the culprit:

/wp-json/batch/v1

which points to the wp2shell attack, combining CVE-2026-63030 (WordPress REST API batch-route confusion) and CVE-2026-60137 (SQL injection) to gain access to the installation. These vulnerabilities were 3 months old, my WordPress updates itself, so how could this old bug be used to compromise the site?

Turns out the installation ran WordPress 7.0-alpha-61406 . Why? No clue why I installed this version. WordPress treats alpha/development builds differently from normal releases. They follow a separate update channel, with their own eligibility rules. And it wasn’t updated.

Now that the system was up and running, I decided that I needed some more protection in case I f*ck up again. I installed CrowdSec which would have detected and blocked this attack. CrowdSec is an open-source, collaborative intrusion detection and prevention system (IDPS), web application firewall (WAF), and bot-detection software.

It monitors my system logs and apache requests to spot aggressive or suspicious behavior like brute-force attacks, port scans, or web scraping. It than blocks the offending IPs from accessing the server. But that might not have been able to detect the attack. But the WAF (Web Application Firewall) would have. Because it can also be embedded into the web-server itself to monitor the data stream. And again – if it detects a malicious attempt, it block the offender before the data even reaches the PHP engine.