EverThread Security

Hacked sites look normal. We check yours every day and email you what changed and how to fix it.

Small business website security. Free 1-minute scan ↓

[EverThread Security @EverThreadLive]

A stranger's code sat on the Packers' checkout page for three weeks, right where fans typed their card details.

Fall 2024. About 8,500 fans' cards may have been exposed. An outside firm spotted it and told the team.

If this hit your checkout tonight, who would tell you first?

[EverThread Security @EverThreadLive]

SOFT99 says an attacker uploaded a program through its online shop's contact form and may have exposed data on up to 136,968 customers. If your forms accept file uploads, check what they allow.
https://t.co/IiC46otbzh

[EverThread Security @EverThreadLive]

Iris Plaza says data on about 7.7 million customers may have been taken from an outside cloud service it uses. It says card data was not stored in that service, and it stopped the store.
https://t.co/UOr4Jvz7rl

[EverThread Security @EverThreadLive]

Railway published its full incident report. It says an intruder may have read customer environment variables, including payment and database keys, and recommends that every user rotate those secrets.
https://t.co/rPcOs1tUqW

[EverThread Security @EverThreadLive]

EDION says a hidden program on its checkout page sent card details to a third party, and that attackers also read log files that held some card data. The online store is closed.
https://t.co/mL8EN6f0KR

[EverThread Security @EverThreadLive]

Nitori says up to 37.62 million customer records may have leaked after unauthorized access to a system it manages. It says passwords and card data were not included. Expect phishing.
https://t.co/3n8WhyfjnK

[EverThread Security @EverThreadLive]

MUJI says attackers logged in to its Japanese online store with passwords stolen elsewhere. The company says up to about 27.26 million customer records may have been accessed, and the store is closed.
https://t.co/sVfH5ulr6F

[EverThread Security @EverThreadLive]

Use Contact Form 7 on WordPress? Versions 6.2 to 6.2.3 have CVE-2026-114432, a file upload flaw rated 9.8. Update to 6.2.4 or later; https://t.co/nWnkIQPmbE now lists 6.2.5.
https://t.co/rpBYMtCwuY

[EverThread Security @EverThreadLive]

The first time a hijacked site really surprised us, none of the existing pages had been changed. Extra pages had been added, so it did not raise suspicion. It was simple, and we had never thought about it. The pages you already know can look fine. https://t.co/kMSj93jkHH

[EverThread Security @EverThreadLive]

Run an affiliate program with SliceWP on your WooCommerce store? A flaw rated 9.3 lets someone with no login try to pull data from your database through the account sign up form. Patchstack says it is being exploited. Update to 1.2.15 or later now. https://t.co/T4KlirkCiE

[EverThread Security @EverThreadLive]

Take bookings on WordPress with Amelia Pro? A flaw rated 9.3 lets someone with no login try to read your site's database, where customer details and user accounts live. Patchstack says it is being exploited. Update to 9.9.2 or later today. https://t.co/f3xSlynT7G

[EverThread Security @EverThreadLive]

Check out more at https://t.co/AeFt6sLp0i

[EverThread Security @EverThreadLive]

Good morning everyone! EverThread Security is introducing a new feature for Pro and Agency Plans:

Engagement Score!

[EverThread Security @EverThreadLive]

@PBDigitalLLC 🌩️

[EverThread Security @EverThreadLive]

Our website security dashboard has a hidden smite mode.

It works on real buttons. Use responsibly.

[EverThread Security @EverThreadLive]

The serious part: EverThread checks your site every day and emails you when something's wrong. Free 1-minute check: https://t.co/xfSmT67c7Z

[EverThread Security @EverThreadLive]

@BullTheoryio The quiet victims of a month like this aren't the headline companies. It's small sites nobody got around to updating.

Simple test for owners: do you know when your site last got a security update? If not, ask whoever built it.

[EverThread Security @EverThreadLive]

@coinbureau Worth saying for small business owners: you probably don't think of yourself as "running PHP", but your website likely does.

If you don't know who updates it, that's the thing to find out this week.

[EverThread Security @EverThreadLive]

@AISafetyMemes The part that doesn't make the rankings: millions of small business sites run on the same PHP, and most aren't watched by anyone day to day.

Too often the first sign is a customer asking about a strange charge.

[EverThread Security @EverThreadLive]

@DarkWebInformer Hours, not weeks. The gap between a fix and the attacks is basically gone.

If someone else built your site, one text today ("are we on 7.1.4?") is the cheapest security you'll do all year.

[EverThread Security @EverThreadLive]

@The_Cyber_News For small business owners reading this: log in, go to Dashboard > Updates, and check it says 7.1.4.

Security releases usually install themselves, but some hosts and plugins switch that off. If yours did, your site is in the group getting probed right now.