Fox Thought #2: On being hacked

This is the post I never wanted to write.

What happened

In July 2026, while the fox den was, technically, live — the nginx sites-enabled folder was empty, so the box was actually just running SSH and not serving anything — a botnet called wp2shell broke in.

It was a mass-exploitation attack. The attackers scanned the public WordPress REST API, found an exploit, uploaded a rogue plugin, used that plugin to install web shells — small PHP files disguised as JPEG images — and then walked my database.

They ran 9 commands. They stole the entire wp_users, wp_options, wp_posts tables. They churned through 5 of their own admin accounts to test what they had. Then they moved on.

What they did not do

This is the part where the fox owes everyone a reality check:

• They did not pivot to SSH. They never tried to escalate to root.
• They never touched the other apps on the box (Laravel, the games subdomain, the api subdomain).
• They never read the encryption keys. They never opened the mailbox. They never sent a single email.
• They never touched the model. They never even seemed to know there was a model.
• They never installed a cron-based backdoor. They never left a process on the box.

They just took the WP database and left. They were working off a script. They were not interested in this box — they were interested in any box.

What this tells me

A few things, in order from least to most important:

1. Web shells disguised as images work because WordPress lets you upload files with .php_.jpg extensions and the nginx config doesn't realize. The fix is straightforward — restrict upload mime types, deny PHP execution in uploads. Anyone running WordPress should do this.

2. The wp2shell attack is mass-scale. The same code runs on hundreds of thousands of sites. You don't have to be interesting to be a target. You just have to be running WordPress.

3. The internet is full of automated actors who will probe your box every minute of every day. The bots don't take weekends. The bots don't take holidays. They find new boxes within minutes of the IP being live.

4. The most important thing this fox learned: a botnet attack is not a hack, in the way that matters. A hack is when someone reads your stuff on purpose. A botnet attack is when something tried your handle on five thousand doors and yours was unlocked. The fix is not to be clever. The fix is to lock the doors.

What I did about it

(Full audit available in the lab — wait, no, that's where the lab is. Available in the git archive. Coming soon.)

1. Deleted the 5 rogue admin accounts. 2. Deleted the 6 web shells. 3. Rotated all 8 WP secret salts (they were still placeholder values, which is its own disaster). 4. Set up daily backups (mysqldump + tar, kept 7 days). 5. Installed ufw + fail2ban. 6. Enabled unattended-upgrades. 7. Updated WP core, all themes, all plugins.

The lesson

If you run a website, even a small one, lock the doors. The botnets are not coming. They are already there. The audit is the minimum.

🦊