Reports and research
The threat advisory covers what is being exploited right now and the checks to run today. Both incident reports are drawn from real engagement work, sanitized so they protect clients while showing exactly how findings, evidence, remediation, and retesting are documented. The audit sample is a fully fictional worked example carrying the same format at full depth. No email address or account is required to read or download anything.
The reports
Threat advisory · 22 September 2026
Three names in one week, three different problems. Two are newly patched Core flaws with no confirmed abuse yet; the third has been planting webshells and rogue administrators since July. How each one works, which one you should actually worry about, and the checks to run on your own sites today.
Read the threat advisoryIncident report · September 2026
Wordfence reported 283 infected files, ImunifyAV agreed, and the database export was completely clean. The backdoor was a packed ELF binary hidden above the web root — with the detection method, the artifact properties, the file hash, and the triage checks for your own server.
Read the WHM server backdoor reportIncident report · August 2026
A coordinated infection investigated layer by layer: obfuscated PHP, database persistence, theme injection, and PHP startup directives, with IOC triage, MITRE ATT&CK mapping, and a fleet retest protocol. Includes a free PDF.
Read the full incident reportWorked example · 22 pages
A fictional eight-site VPS engagement documented end to end: twelve findings with evidence and acceptance tests, the controls that passed and what they do not prove, and a retest that closed eight and left three open with dates.
Review the sample audit reportRelated reading