Tidbits from Brian - Issue #58
How wp2shell took down our site, 😨 but not the way you think.
Many of you probably read about the security issue from WordPress core last week regarding wp2shell. Or perhaps you saw the update (7.0.2) that they pushed out to fix it. Essentially, a security flaw let attackers take over a website without needing a username or password, by exploiting a REST API endpoint that WordPress leaves open by design. As Wordfence put it, it’s the first critical unauthenticated WordPress core RCE in nearly a decade. It was bad!
We have the REST API endpoints locked down on our sites, except for back-end products that need it. And our sites were also updated immediately. So while I was aware of everything going on, I didn’t give it a second thought after confirming we wouldn’t have been impacted.
Well, ironically, wp2shell ended up taking down our site (backend and checkout), but not in the way we had anticipated. It started out with massive 400 and 500 errors, suddenly overwhelming the site. We’re talking about thousands of requests. We were also seeing average PHP/MySQL request time spike well over 1,500%.
I’ve dealt with some pretty crazy DDoS attacks in the past, but this one was strange right off the bat simply because it was an overwhelming number of 400 and 500 errors. A 404 error specifically means “HTTP 401 Unauthorized.” Thankfully, I was quick to connect the dots after what happened last week. Our raw Nginx access logs had thousands of requests looking for “/wp-json/batch/v1.” So I immediately knew it was wp2shell.
It turns out our REST API endpoints were locked down, but not at the edge (Cloudflare). What looked like a DDoS was actually mass exploitation scanning for the wp2shell WordPress core RCE. The request volume was high enough to cause denial-of-service symptoms as a byproduct.
Fixing it was pretty easy. I first increased our bot protection level with Kinsta, our hosting provider. If you haven’t seen this new feature (in beta), it is great! It’s essentially just utilizing the Cloudflare Enterprise integration behind the scenes, but in a much easier way. I’ve mitigated attacks directly in Cloudflare before, and it can be more cumbersome.
This immediately stopped about 95% of the bad traffic with a few clicks.
You can see here where we went from only blocking a few thousand requests a day to hundreds of thousands.
In fact, at the peak of the attack, over 96% of the traffic was either being blocked or challenged. 😮 This is out of 1.6 million requests over a 24-hour time period.
Obviously, when it comes to bot protection, it’s always a fine line between blocking the bad while still allowing the good through. So you do want to be careful and monitor things. If you’re using this feature at Kinsta, I recommend enabling the “Allow typical WordPress automations” feature. You might also want to add IPs or paths to the “Always Allow” section. Some of this depends on the type of site you have.
It’s very easy to change protection levels if you need to mitigate a bad attack and then go back. As with most DDoS attacks or mass exploitation scanning, things usually die down once they realize they are wasting their resources. They will move on to the next victim.
Another thing I did was block a few IP ranges. It’s very easy in MyKinsta analytics to see top IPs over a period of time. I recommend using AI along with a couple of different tools to confirm who the IP might belong to: IPinfo, AbuseIPDB, and ipgeolocation. Many times, an IP will already be flagged for abuse. If it is, you can use Kinsta’s IP Deny tool to completely block it. Cloudflare Enterprise is usually really good at doing this automatically, but once in a while, something slips through.
This is one of those instances where I simply hadn’t anticipated everything. Looking back now, of course, they would be scanning for the exploit. I just didn’t think it would be hundreds of thousands of requests from different sources. And going forward, we have more aggressive blocking in place.
If you haven’t updated your WordPress site to 7.0.2 for some reason (perhaps you have automatic security updates turned off), I recommend you do it right away. You can also use this free wp2shell tool to see if your site is currently at risk. Wordfence also published a list of bad actor IPs you can check against your logs.
Updates ✍️
We pushed out an update for our Novashare WordPress plugin. Here are a few of the changes:
Added new custom option for link shortening. You can now use any link shortener of your choice, such as Short, Rebrandly, PrettyLinks, YOURLs, TinyURL, etc. If they have any API/function, you should be able to hook it up. 🎉
Added novashare_short_link_generated action for short link integrations (novashare_bitly_link_generated kept for backward compatibility).
Renamed the previous Bitly option to enable link shortening. Bitly is still the default choice.
Added a missing capability check to the refresh share counts AJAX action.
Added a missing nonce check to license key save, activate, deactivate, and remove actions.
Added ABSPATH checks to plugin include files where needed.
Hardened sanitization for color and custom CSS field output. 🔒
Improved escaping and sanitization for meta box fields and various frontend links and attributes.
Fixed a block editor error that could occur when a previously selected network was no longer available.
Fixed Click to Post blocks spanning full width in the block editor.
Fixed W3C validation issues with certain network share links. 🪲
Adjusted image upload preview thumbnails in the plugin settings to match WordPress admin input heights across versions.
Removed Yummly share network from the plugin, as the service is no longer active.
We also pushed out a small update for our Perfmatters WordPress plugin. Here are a few of the changes:
Improved code snippet docblock parsing to use UTF-8 aware regex when reading snippet metadata.
Improved reliability of snippet metadata parsing across different server environments.
Fixed an issue with multiline code snippet descriptions not saving properly.
Fixed an issue where the database optimization process button spinner was getting stuck without reloading the page.
Translation updates.
Affiliate program updates
We made a change to our affiliate program with both plugins. We’ve introduced a minimum threshold of $25.00. If your eligible commissions haven’t reached $25 in a given month, they’ll roll over and continue accruing until they do.
We’ve actually received some criticism about the no-minimum policy (mainly due to payment processor fees and the fact that we pay recurring commissions). This should cut down on fees, time, and emails for everyone going forward.
Interesting things 🔎
Misc.
OnePlus confirms shutdown in the US and Europe. I never owned one, but I know some who did, and they really liked them. 📱
Looking for a free Raycast alternative? Introducing Tinycast. It’s small, blazing-fast, and fully native, written in Swift. It’s open source, and there is no telemetry.
WordPress
The webhosting.com domain name was acquired by Automattic. They already have a few hosting brands, so curious what they will use this for.
Austin launched Minn Admin, a free, modern, minimal dashboard served at /minn-admin/. It’s a single-page app using the WordPress REST API. Pretty neat! And it lives alongside your regular dashboard.
I’m a big fan of InstaWP and use it regularly for plugin testing, taking screenshots, etc. However, it’s great to see more options launching in the space. Check out SandyWP.
WordPress drops to 41.5% market share, but three datasets tell different stories.
Jean also shared some stats on how the WordPress plugin business model is breaking.
Curt also shared his take on the market share data.
You can now control the client editor experience with GenerateBlocks editor access.
WooCommerce is limiting contributions to three pull requests at a time. I don’t blame them, as many of them were probably AI-generated. You still need to focus on quality over quantity at some point.
Contributors reverse course on plan to begin phasing out the classic block.
Responsive styling per device is being worked on for WordPress 7.1.
Is something wrong with the WordPress.org popular themes list? Check out Pavel’s two-year investigation.
There is a merge proposal for design system theming. One interesting thing this could potentially unlock is a native dark mode in core. I’m a sucker for dark mode. 🌓
Marketing
It’s 2026, and I’m just now finding out that you can change the “Undo Send” timer in Gmail. Better late than never. 😅 I’ve used it quite a few times, even on the default 5 seconds.
You can now hook up X, TikTok, YouTube, and Instagram in Google Search Console to pull in even more data.
Performance
Cloudflare Workers can now have their own cache. R2 is also now generally available for object storage.
WordPress 7.1 is getting client-side media processing. I definitely recommend testing, as it might impact how you handle images.
Introducing psi-bench. A tool where you can run, analyze, and compare repeated PageSpeed Insights tests across multiple pages. Great for those multitasking.
Brave launches containers. This is actually pretty cool. Especially for those in web development or using Chrome DevTools a lot (for example, troubleshooting performance).
AI
No, people don’t want more AI in their life. I really enjoyed this article. While I obviously use AI constantly, the slop is out of control. For example, HeyGen just launched video podcasts. I’m sorry, but if I’m watching a podcast, it needs to be real people. I will instantly unfollow anyone doing this. 😅
OpenAI is deprecating Atlas and moving browser-based agentic capabilities into ChatGPT and Codex. James showcased this a little more. They also added voice control to the desktop app.
Google Vids now lets you star in your own AI videos.
OpenAI launched GPT‑5.6 (Sol, Terra, Luna tiers). And on July 30, they reduced the price of GPT‑5.6 Luna by 80% and GPT‑5.6 Terra by 20%.
You can now teach Claude a skill. Record your screen while you do a task, talk through it as you go, and Claude turns it into a skill it can run again. They also launched their security plugin for Claude Code.
SpaceXAI launched Groke 4.5, a faster and cheaper AI model that’s really good at coding and office tasks like Excel and PowerPoint. They also launched an app builder for Grok.
Google released three new, faster, and cheaper AI models (3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber).
Gemini for macOS gets natural voice dictation and screen reasoning. The one thing that’s interesting is that it inserts text directly at the cursor in any app, not just in Gemini. Possibly a Wispr Flow alternative.
If you're in the Scottsdale, AZ area, hit me up, and we can grab lunch! 🥗👋