Disaster management for when you get 1000s of customers hacked
summary
A plugin bug in PHP unserialize leads to remote code execution and overnight compromise of 1000s of customer sites even though the plugin has 20,000+ installs. Response builds lightweight scanners and log-parsers to comb terabytes of logs, uses an internal tool that flags signs across 200,000 sites, shifts the unsafe code to verified-input paths, runs bulk cleanups and multi-channel support, and spends a month auditing to confirm the patch — fixes land and recovery succeeds with community help.
AI-written summary · about
chapters (22)
- 0:00Akshat Choudhary Founder of BlogVault
- 0:10WordPress Backup Service
- 1:49Must be WordPress
- 2:09Fire Common pattern
- 2:23Best Security Practices
- 2:37Solved Hacks Earlier Timthumb. Gravity Forms. Etc
- 2:58Emergency Totally unprepared for it
- 3:25What to do? What to tell our customers? How?
- 3:52Help Every Customer
- 4:46Communicate Team, Partners and Customers
- 5:44Headless Chicken
- 6:14Plans and Processes
- 7:11Vulnerability unserialize
- 7:55Worst-case Situation
- 8:37Leave no stone unturned
- 9:47Forgive Mistakes will be made
- 10:52Panic Only makes things worse
- 11:17Shy away from Truth Integrity is most Important
- 11:45Focus Inwards Business is about Customers. Help them first
- 12:24Community The WordPress community is your best friend
- 13:17Biggest Supporters Customers will understand and help you.
- 14:03Thank You
related talks
33mThe Anatomy of a Hack 24 Hours in the DevSecOps ER
44mI've Been Hacked, Now What
43mI Had WordPress, but It Got Hacked
02h 18mWeb application security (Part 2)
42mOops, there's someone in my package manager!
01h 00mHack to the Future
38mWhat The PHUZZ?! Finding 0-Days In PHP Apps wt Coverage-guided Fuzzing
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively