Moatline.io

Free WordPress malware scanner that finds what others miss: injected files, fake plugins, database scripts. Built by @nextnovatech.

[Moatline.io @moatlineio]

Moatline 1.4 is out (free): a 2-minute set-up wizard, an "I think I've been hacked" checklist based on how we clean sites, and a simpler layout. Also detects the OptinMonster CDN backdoor.
https://t.co/4hlmT1lyfe

[Moatline.io @moatlineio]

A site asks you to press Windows + R, paste, and press Enter to "verify you are human"? Close it. No real site asks that. It installs malware, and the site showing it has been hacked.
Site owners, 7 signs to check: https://t.co/C5qgcdoNlw

[Dr.Philippe Vynckier, CISSP - Influencer @PVynckier]

Dire Wolf ransomware: An apex predator stalking your data | Barracuda Networks Blog https://t.co/YvdbMZg9Eg

[The Hacker News @TheHackersNews]

‼️ BREAKING - Critical Apache HTTP/2 flaw could allow unauthenticated remote code execution.

CVE-2026-119618 affects versions 2.4.55–2.4.70 with HTTP/2 enabled.

CVSS 9.8. Fixed in 2.4.71, but some #Linux distributions still await patches.

Read more → https://t.co/pqK7XVed3I

[Moatline.io @moatlineio]

@TheHackersNews For WordPress site owners: this one is your host's job, not a plugin update. If your site runs on Apache 2.4.55–2.4.70 with HTTP/2, ask your host when they'll be on 2.4.71. LiteSpeed and Nginx-only servers aren't affected. No attacks reported yet.

[Moatline.io @moatlineio]

WordPress says 3 admins, but you can only see 2? Malware can hide an attacker's admin from the Users screen.

3 ways to find every admin, even hidden ones (4:43): https://t.co/QwPTaChEvL
Guide: https://t.co/x3bChtcQ2H

[Moatline.io @moatlineio]

Hacked only on phones? Redirect malware often hits only mobile visitors from Google, once each, so your site looks fine when you check it. If a customer says it went somewhere strange, believe them.
7 signs to check: https://t.co/C5qgcdoNlw

[Moatline.io @moatlineio]

Using Contact Form 7? Update to 6.2.4. Versions 6.2–6.2.3 let anyone upload any file through a form with a file upload field, no login needed (CVE-2026-114432). No attacks reported yet. Gravity Forms users: 3.1.3+.
https://t.co/Oz8LfKm0Za

[cve.now @cvedotnow]

🔴 CRITICAL 9.8 · EASY-JS-WPAPI Client HANDLE for the WordPress REST-API: auth bypass, admin creds leaked (CVE-2026-115213)

👉 No patch listed yet
https://t.co/CYI7oe1AQ8

[International Cyber Digest @IntCyberDigest]

❗️ A Reddit post accuses GoDaddy of grabbing the domains people search for.

GoDaddy is the world's biggest registrar, and has denied this practice, known as front-running, since at least 2012.

Since 2025 its site has shown a notice saying it does not register domains for itself or partners based on your searches.

[The Hacker News @TheHackersNews]

🚨 A single hacker in Taiwan used BOSSAI, a 12-agent AI hacking setup, to steal Taipei emergency dispatch records.

The operation targeted hundreds of organizations across 11 countries, with confirmed data extraction in three.

Learn More ↓ https://t.co/wNlpavj7dD

[Dr.Philippe Vynckier, CISSP - Influencer @PVynckier]

Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing https://t.co/D0MVNa2MGf

[Moatline.io @moatlineio]

Updating to WordPress 7.1.4? The update still runs the old, vulnerable updater one last time (CVE-2026-119977).
Block wp-content/upgrade first, check it returns 403, then update. WP-CLI too.
https://t.co/ExqbrLz2Ie

[Dr.Philippe Vynckier, CISSP - Influencer @PVynckier]

Hackers Exploit WordPress Core RCE Vulnerability in Over 240,000 Attack Attempts https://t.co/XgwVzHlFkP

[Moatline.io @moatlineio]

@PVynckier Worth adding: the 7.1.4 update is unpacked by the old, vulnerable updater, and WP-CLI uses the same one. Block wp-content/upgrade in your main .htaccess first (not inside that folder, it gets emptied), check it returns 403, then update. Rules: https://t.co/ExqbrLz2Ie

[Moatline.io @moatlineio]

Your site looks fine… to you 👀 Hacked WordPress sites hide from logged-in admins and only show spam to visitors from Google, often on phones.
Free check: https://t.co/TEmyV7XnoP

[Moatline.io @moatlineio]

Most WordPress hacks start with an old plugin, a stolen password or a "nulled" theme. 5 free fixes for today: update everything, remove unknown admins, 2FA for admins, block PHP in uploads, off-site backups kept 30 days.
https://t.co/wmeHzKO4LD

[Moatline.io @moatlineio]

Most hacked WordPress sites look normal to their owners. The malware hides from logged-in admins.
7 signs your site is hacked + a free 2-minute check, in under 4 minutes: https://t.co/C5qgcdoNlw

[Moatline.io @moatlineio]

@wordfence Thanks for sharing the numbers. One thing worth adding for anyone updating from an old version: the update itself runs the vulnerable unpack step one last time, so deny web access to wp-content/upgrade first, then update.

[Moatline.io @moatlineio]

@TheHackersNews If you run CWP, check for the ngx_http_integrity_helper process or socket. Clean access logs prove nothing here, because the backdoor removes its own requests. If it’s there, replace the cwpsrv binary, upgrade CWP and change your panel passwords.

[Moatline.io @moatlineio]

@IntCyberDigest That’s why the order matters: close the folder before you update, not after. Deny web access to wp-content/upgrade (WordPress never needs it), update, then check that folder for leftover .php files and your Users list for new admins. Server rules: https://t.co/ExqbrLz2Ie