“Who would bother hacking us?” is the most common security objection we hear — and it rests on a misunderstanding of who, or rather what, is doing the attacking.

Neal Agarwal’s I’m Not a Robot is 48 CAPTCHAs in a row, with a certificate at the end declaring you a human being. GPT-6 Astra played it start to finish and got the certificate. Every level is a new interface with rules nobody explains, and the model figured out what each one wanted and clicked. […]

Modern infections don’t deface your homepage — they hide from you specifically, while showing malware to your visitors. A walkthrough of how a compromise actually unfolds, and what to do hour by hour.

The official MCP Adapter exposes site actions as tools that AI agents can call. What it needs, and how to connect one without handing it your admin account.

AI now writes plugins on demand and React front-ends by prompt. The productivity is real. So are the vulnerabilities. Here’s how we use AI in development without shipping its mistakes.

Almost every site we take over has backups running. Far fewer have a restore that anyone has tested. The six failures we keep finding, and what to change.

Claude Cowork now has its own browser. When a task involves a website, a panel opens next to the chat and Claude clicks, reads and fills forms in there while you carry on with whatever you were doing. That browser has nothing to do with yours. Your tabs and passwords stay invisible to it, which […]

From September 11, 2026, the EU requires software manufacturers to report actively exploited vulnerabilities within 24 hours. Here’s what that means for WordPress sites, plugins, and the people who run them.

The median time between a critical WordPress vulnerability being disclosed and mass exploitation is now five hours. Manual patching didn’t lose the race — the race changed.