Urgent: WordPress core flaw CVE-2026-119977 is being exploited
An unauthenticated code execution flaw in WordPress core upgrades is under active attack. Here is who is affected and what to do today.
Blog
Notes from running a WAF on real traffic.
What we learn running DBshieldX on our own production sites: scanners, monitor mode, safe blocking and the database layer. No attack recipes, just what to do about them.
Why a WAF should check your SQL, not just your HTTP requests
Request rules see what arrives at your site. A query check sees what reaches your database. How learning your app's query shapes adds a second line of defence.
Why your site gets .env and wp-login probes, and what to do about them
Automated scanners ask every website for config files and WordPress login pages, whatever it runs. Why it happens, and the simple steps that make it harmless.
What is WAF monitor mode, and why start there?
Monitor mode lets a web application firewall show what it would block without touching real visitors. Why it's the safe first step, and how to know when to block.