EverThread Security

Hacked sites look normal. We check yours every day and email you what changed and how to fix it.

Small business website security. Free 1-minute scan ↓

[EverThread Security @EverThreadLive]

A stranger's code sat on the Packers' checkout page for three weeks, right where fans typed their card details.

Fall 2024. About 8,500 fans' cards may have been exposed. An outside firm spotted it and told the team.

If this hit your checkout tonight, who would tell you first?

[EverThread Security @EverThreadLive]

Euglena says its akyrise online shop was broken into and up to about 900,000 customer records may have leaked. It says card numbers were not included. The shop is closed.
https://t.co/5Xzr4zcS3V

[EverThread Security @EverThreadLive]

Use WooCommerce Stripe Gateway? WooCommerce says update to 11.2.0 or 11.1.2. It says the most significant issues could allow fraudulent purchases, and it has no evidence they have been exploited. If you ran 10.9.0, check for stored passwords.
https://t.co/OeFhTlM5Ni

[EverThread Security @EverThreadLive]

We found a .env file exposed on a site by accident, during Shield Audit testing. It was not originally in the basic check. We added it to the lower-tier scan because it mattered enough. If anyone can download yours, assume those secrets are already gone. https://t.co/uVn60gWOv6

[EverThread Security @EverThreadLive]

SOFT99 says an attacker uploaded a program through its online shop's contact form and may have exposed data on up to 136,968 customers. If your forms accept file uploads, check what they allow.
https://t.co/IiC46otbzh

[EverThread Security @EverThreadLive]

Iris Plaza says data on about 7.7 million customers may have been taken from an outside cloud service it uses. It says card data was not stored in that service, and it stopped the store.
https://t.co/UOr4Jvz7rl

[EverThread Security @EverThreadLive]

Railway published its full incident report. It says an intruder may have read customer environment variables, including payment and database keys, and recommends that every user rotate those secrets.
https://t.co/rPcOs1tUqW

[EverThread Security @EverThreadLive]

EDION says a hidden program on its checkout page sent card details to a third party, and that attackers also read log files that held some card data. The online store is closed.
https://t.co/mL8EN6f0KR

[EverThread Security @EverThreadLive]

Nitori says up to 37.62 million customer records may have leaked after unauthorized access to a system it manages. It says passwords and card data were not included. Expect phishing.
https://t.co/3n8WhyfjnK

[EverThread Security @EverThreadLive]

MUJI says attackers logged in to its Japanese online store with passwords stolen elsewhere. The company says up to about 27.26 million customer records may have been accessed, and the store is closed.
https://t.co/sVfH5ulr6F

[EverThread Security @EverThreadLive]

Use Contact Form 7 on WordPress? Versions 6.2 to 6.2.3 have CVE-2026-114432, a file upload flaw rated 9.8. Update to 6.2.4 or later; https://t.co/nWnkIQPmbE now lists 6.2.5.
https://t.co/rpBYMtCwuY

[EverThread Security @EverThreadLive]

The first time a hijacked site really surprised us, none of the existing pages had been changed. Extra pages had been added, so it did not raise suspicion. It was simple, and we had never thought about it. The pages you already know can look fine. https://t.co/kMSj93jkHH

[EverThread Security @EverThreadLive]

Run an affiliate program with SliceWP on your WooCommerce store? A flaw rated 9.3 lets someone with no login try to pull data from your database through the account sign up form. Patchstack says it is being exploited. Update to 1.2.15 or later now. https://t.co/T4KlirkCiE

[EverThread Security @EverThreadLive]

Take bookings on WordPress with Amelia Pro? A flaw rated 9.3 lets someone with no login try to read your site's database, where customer details and user accounts live. Patchstack says it is being exploited. Update to 9.9.2 or later today. https://t.co/f3xSlynT7G

[EverThread Security @EverThreadLive]

Check out more at https://t.co/AeFt6sLp0i

[EverThread Security @EverThreadLive]

Good morning everyone! EverThread Security is introducing a new feature for Pro and Agency Plans:

Engagement Score!

[EverThread Security @EverThreadLive]

@PBDigitalLLC 🌩️

[EverThread Security @EverThreadLive]

Our website security dashboard has a hidden smite mode.

It works on real buttons. Use responsibly.

[EverThread Security @EverThreadLive]

The serious part: EverThread checks your site every day and emails you when something's wrong. Free 1-minute check: https://t.co/xfSmT67c7Z

[EverThread Security @EverThreadLive]

@BullTheoryio The quiet victims of a month like this aren't the headline companies. It's small sites nobody got around to updating.

Simple test for owners: do you know when your site last got a security update? If not, ask whoever built it.

[EverThread Security @EverThreadLive]

@coinbureau Worth saying for small business owners: you probably don't think of yourself as "running PHP", but your website likely does.

If you don't know who updates it, that's the thing to find out this week.