On a Friday evening, most people are tidying their desks. We spent the evening and part of the night updating every single one of our clients' sites. Three nights later, we did it all again on the server layer, this time at around three in the morning.
Two critical vulnerabilities in four days. Not one of our clients had to lift a finger. Most of them found out by reading our intervention report on Monday morning.
What happened on Friday
A vulnerability was made public in the WordPress core. Not in some obscure plugin downloaded six years ago: in WordPress itself, on a default installation.
Named wp2shell, it allows a stranger, with no account and no password, to run code on your server by sending a few requests. From there, they can read your database, harvest your contacts, install a backdoor and wait quietly.
WordPress powers around 500 million websites worldwide. A critical core vulnerability of this kind, with no prerequisites at all, comes along once every five or six years.
WordPress did try to force an automatic update on all sites. The problem — and this is the paradox of the story — is that this forced update fails silently on well-built professional installations: those under version control, those with locked-down file permissions, those whose automatic updates have been deliberately disabled to prevent a patch from breaking a live site on a Sunday.
In other words: the more seriously your site has been built, the less the automatic safety net protects you. Someone has to be behind it.
What happened last night
Here we go again, but one floor down. This time the vulnerability affects NGINX, the web server that delivers the pages for the vast majority of our hosting. Severity score: 9.2 out of 10.
In the best case, the site goes down. In the worst, an attacker takes control of the server. And the affected versions date back to 2011, which means more or less everyone was exposed.
The researcher who discovered it will publish their exploit code in three weeks. The race is on: between the moment a fix is released and the moment automated attacks begin, we are now talking about a few days. Sometimes a few hours.
Our servers were moved to the patched version last night. Not at the next maintenance window. Last night.
It is a service we offer to all our clients.
Why things are not going to get better
Three critical vulnerabilities of the same type have been found in NGINX in two months. A major vulnerability in the WordPress core, something that had not happened in years. This pace is no coincidence.
Artificial intelligence has become formidable at one specific task: reading millions of lines of code and spotting what is wrong. An audit that used to take an expert three weeks can now be done overnight. That is excellent news for security researchers. It is exactly the same excellent news for attackers, who use the same tools.
Two very concrete consequences for the months ahead. The number of critical vulnerabilities will rise, including in software we thought had been solid for fifteen years. And the time before mass exploitation will keep shrinking.
Monthly maintenance no longer makes sense in this context. Nor does weekly. What protects a site today is a team that monitors security disclosures continuously, knows within thirty seconds which servers are affected, and has the authority and the skills to work on a live production system at three in the morning.
What you are really risking
The argument comes up often: "my site is just a shop window, there is nothing to steal". That is a misjudgement.
A compromised site is almost never used to attack your business directly. It is used to host scam pages under your domain name, to send spam from your address, to redirect your visitors elsewhere. The result: Google flags your domain as dangerous, your sales emails land in your own clients' spam folders, and it then takes weeks to put things right.
And then there is the data leak. Your database holds your subscribers, your contact forms, sometimes CVs or quotes. Under the GDPR, you have 72 hours to notify the Data Protection Authority. But the fine is not what hurts most. It is the email you have to write to your clients telling them their details are out in the wild.
A reputation takes twenty years to build and a weekend to destroy.
That is what a hosting provider really does
We do not sell disk space. Anyone can sell you that for four euros a month, and at that price, nobody gets up in the night for you.
What we sell is a team that reads security alerts on a Friday evening. That knows the exact inventory of what runs on every server without having to go and check. That tests a fix before pushing it to production, because a patch applied blindly can break a site just as surely as an attack. And that is willing to lose a night's sleep when the situation demands it.
Twenty-five years of hosting press and media websites have taught us one simple thing: security is not a product you buy once. It is human time, paid for continuously, by people who know what they are looking at. As AI speeds up the discovery of vulnerabilities, that human time is becoming the most decisive part of hosting. And the only part that cannot be automated.
If you do not know who updated your sites this weekend, chances are nobody did.
Let us look at it with you
We offer a free audit of your current installation: the versions actually in place, your level of exposure, any traces of compromise, and what should be done first. No commitment, even if you stay with your current provider.
Email us at info@artwhere.eu or call +32 475 29 31 46.
Frequently asked questions
How do I know if my site is affected? Check your WordPress version under Dashboard, Updates. If it is lower than 7.0.2 or 6.9.5, you are exposed. Do not assume the automatic update went through: it fails silently in many cases.
I have a firewall — is that enough? No. A firewall reduces the risk while you apply the fix; it does not repair the vulnerable code. It is a sticking plaster for a few hours, not a solution.
My site ran a vulnerable version all weekend. What should I do? Update, then check. A site that has already been compromised stays compromised after the fix: you need to check administrator accounts, the WordPress core files and scheduled tasks. This check is not optional.
I am not an ArtWhere client — can you still help me? Yes. We always start with an audit of your existing setup, and we will tell you frankly whether taking it over is justified or not.
Get in touch
ArtWhere, digital innovation