1/ On Monday I said the real risk in AI-built apps is boring: shipping with no security gate. Here's the worst one I found this week.

4/ The catch: a code scanner doesn't flag this. The code is valid. It just trusts the wrong source. It took a reasoning pass to find it.

5/ Fix is real work: price from the server, verify with a signed webhook, reject duplicate events.
How much of your checkout trusts the browser?

Everyone fears AI writing malware. The real risk is more boring: it ships an unauthenticated route to your production DB and calls it done. Looks finished. Runs fine. Wide open. What's the 1st thing you check in AI-generated code?

Check out my latest article: AI Built It, AI Will Break It linkedin.com/pulse/ai-built… via @LinkedIn

Here's a recent website malware case we worked:

wewatchyourwebsite.com/hunting-wordpr…

I kept hearing about how "everyone" is using Fail2ban and/or Imunify360 to block attacks on xmlrpc.php and wp-login.php on their WordPress sites.

Here's the truth.

wewatchyourwebsite.com/92-of-attacker…

Since we've been actively sending abuse reports, we thought this might be interesting to those in the hosting space.

wewatchyourwebsite.com/the-hidden-cos…

Check out my latest article: When Security Plugins Aren't Enough: What 111,354 Infected Websites Taught Us About Modern WordPress Attacks linkedin.com/pulse/when-sec… via @LinkedIn

I know some who believe info stealers aren't real, but...

techradar.com/pro/security/c…

A few weeks ago, court documents revealed that Meta/Facebook was siphoning user data for competitive intelligence.

Even their top security engineer said that it was uncool.

Remember, if you use a free service (or a service pays you to use it), then YOU are the product.

When our online security, the last thing you want is for your data to be exploited for competitive analysis. It's crucial to choose your VPNs wisely. In today's video, I explain what happened and which VPNs are my primary choice.

youtu.be/9E4V1-UochE

The @bricksbuilderio team has absolutely knocked it out of the park with these security features.

I could not have thought of a better "comeback" after the patched vulnerability.

WP Vendors take note, that's how it's done.

bricksbuilder.io/release/bricks…

Sign-up! @kathyzant is the real deal!

greengeeks.com/webinars/new-a…

Handled another site that got hacked today, but this one was a bit more sneaky than ususal, so I enlisted the help of @WeWatch it's been properly taken care off.

10/10 would recommend.

Booked Thomas to be on my @Within_WP podcast as well, btw. Should be a good one!

Attention!

Update your Bricks sites immediately!

**Drop everything** what you do and update your sites.

I want to highlight that the Bricks team has been exceptional in their cooperation in getting this fixed as per our recommendations.

POC in 24h.

snicco.io/vulnerability-…

cybernews.com/security/cyber…

Good read for people who still don't believe session cookie theft is a "thing". But what do I know? I've been called a charlatan. LOL

"Infostealers, for a very long time, have used cookie theft as a way to get access to accounts,”

If you haven't already, take some time and check this out.

I had an awesome conversation with @westguard about how to prevent SPAM from your contact forms earlier today.

I swear I learned more about the topic in this call than I have in the last 5 years!

Full explainer, recommendations and the video replay here: theadminbar.com/effective-spam…