📝 Show notes
CyberAware Daily — 2026-10-02
- WordPress backdoor that rebuilds itself after cleanup using files, database, and shared memory.
- Who is affected: website owners, especially small businesses and charities running WordPress.
- Dutch police arrest hacker in Shiny Hunters investigation.
- Weekend checklist: turn on two-factor authentication, use unique passwords, check bank statements, verify unexpected messages.
- For website owners: ensure backups are separate, ask your host about malware cleanup.
- One action: enable two-factor authentication on your email and bank today.
More at https://cyberawareuk.co.uk
📄 Full transcript
It's Friday, welcome back to CyberAware UK. I am here with Alex, and today we're doing our
weekend prep, a quick look back at the week and a checklist you can actually use.
And we've got a fresh story today about a hacked website that just won't stay fixed.
A WordPress backdoor that rebuilds itself even after you clean it up. That's worth understanding.
Right. So the report is about a backdoor hidden in WordPress sites.
The clever bit is that when someone removes the malicious code, it comes back.
It pulls itself together using files, the database, and shared memory.
Shared memory. Like the server's short-term memory.
Exactly. So it's not just sitting in one file you can delete.
Right. It's stashed in a few places, and if any one piece survives, it can rebuild the rest.
Who does this affect? The report is really about website owners,
small businesses, maybe clubs, or charities running their own WordPress site.
Yes. If you're just browsing or shopping online, this isn't something you need to panic about.
It's the person running the site who has to deal with it.
So if you do run a WordPress site, what should you do?
First, if you've had a hack before and just deleted the bad file, don't assume it's gone.
Get someone who knows what they're doing to check the database and the server memory too.
And keep your WordPress, themes, and plugins up to date.
Noted. Now, other news this week.
Dutch police arrested a hacker in connection with the Shiny Hunters investigation.
That's a group linked to a lot of data breaches.
Yes, and it's a good reminder that these investigations do lead somewhere, even if it takes time.
We won't go into the details, but it's a positive step.
And there was a big roundup of threats this week, including something about 543,000 live secrets exposed.
We covered the GitHub one recently, so we'll just mention it's still a problem.
Exactly. Developers, if you're pushing code, double-check you haven't left passwords or keys in there.
It's easy to do and it's a common mistake.
Now, let's get to the weekend checklist.
What should our listeners actually do this weekend to stay safe?
Start with your online accounts.
If you haven't turned on two-factor authentication for your email, your bank, or your social media, do that this weekend.
It's the single best thing you can do.
And what about passwords?
If you're using the same password on more than one site, change that.
Use a password manager if you can.
It remembers them so you don't have to.
Yes, check your bank statements and credit reports for anything you don't recognize.
And if you get an unexpected text or email asking for personal details, don't click the link.
Go to the official website or call the number on your card.
Good advice.
And for the small business owners or anyone running a website, make sure your backups are working and stored somewhere separate.
Right.
And if you use a managed hosting provider, ask them what they do to clean up malware.
Some will just remove the file and not check the rest.
So the one thing to take away this weekend.
Turn on two-factor authentication for your email and your bank.
It takes five minutes and it stops most account takeovers.
That's it for today.
Stay safe and we'll be back on Monday with more.
Thanks for listening.
Thanks for listening.