Our views on technology, security, marketing & design
AllAICloud BackupCloud SecurityConsumer ProtectionCritical InfrastructureCybersecurityData BreachData ProtectionDigital MarketingEmployee TrainingEthicsIT SecurityLocal BusinessLocal NewsMacNewsPrivacyScamsSelf-HostingShared HostingSmall BusinessSmart HomeTechnologyTips & TricksUncategorizedWeb Design
/
July 19, 2026
A critical pre-auth WordPress RCE (wp2shell / CVE-2026-63030) is under active exploitation. Here’s the nginx and Apache mitigation, how to hunt for an uploaded webshell, and how to audit every site’s database for a rogue admin in one pass.
Happy World Ice Cream Day! July 19 got us thinking about the question we hear from business owners more than almost any other: ‘What kind of website do I actually need?’ The honest answer is the same one you’d give at the ice cream counter: it depends on your flavor. Here’s the menu — the Classic Scoop (the portfolio site that seals the deal when referrals look you up), the Double Scoop (built to get you found in Google and AI search), and the Whole Sundae (the full business platform: CRM, invoicing, online payments, e-commerce, and newsletters for schools, trades, and real estate). Every flavor hand-churned by a real engineer — no AI slop, no template mills — built to make you stand out, and managed for growth with quarterly reviews.
Microsoft just mapped a year-long data theft campaign that pulled customer records out of company after company’s Salesforce systems — and in a full year of stealing, the attackers never broke a single lock. Microsoft is explicit: this was not a Salesforce flaw. Every door was opened with a key the victim had already handed out — approved connected apps, stolen vendor keys, and guest access nobody locked down. Here’s why your business has these keys out too, why no alarm would notice, and the standing-key checklist worth running this week.
Every week we talk about other people’s businesses. Today, with 2026 at its halfway mark, we’re turning the lens on ourselves: what we’ve built, launched, and learned in the first half — 35+ businesses on our managed platform, a one-page site rebuilt into 25 and ranked #1 on Google, new services launched, and a build process proven again and again. Then we hand you the mirror: the halftime checklist every owner should run on their own website. Ours is written. Let’s make your second half the better half.
Two weeks ago we covered the scam that tricks you into infecting your own computer. New research just revealed what it’s grown into: a researcher analyzed 3,000 live samples and found automated servers handing every visitor the same trap in a freshly generated disguise — plus ready-made kits sold criminal-to-criminal, adoption by state-backed groups, and a technique Microsoft’s experts trace to nearly half of break-ins. The good news: the one human rule that defeats it hasn’t changed.
Aflac Japan just disclosed a breach exposing 4.38 million people — but the number that should stop every business owner is ten: the days attackers spent inside before anyone noticed. And they weren’t caught by an alarm; they were caught by a performance hiccup. If attackers were inside your systems right now, what exactly would notice them? For most small businesses the honest answer is: nothing, and no one. Here’s the detection lesson worth taking from this one.
Microsoft is warning about a phishing campaign aimed at hotels: emails posing as guest complaints, booking inquiries, and health-inspection notices, with ‘photos’ of the problem attached. The photos are the trap — and the emails pass standard authenticity checks because they’re routed through real, trusted services. Here’s why this trick beats good employees, why every customer-facing inbox is at risk (not just hotels), and the one verification habit that stops it.
The 2026 World Cup is in full swing — and criminals prepared for kickoff more thoroughly than some of the teams. Researchers and the FBI have documented one of the largest fraud waves ever tied to a single event: 4,300+ fake FIFA websites, a 60x spike in fake betting apps, fake streams, hotel lookalikes, and thousands more fake domains parked and waiting. Here’s how the scams work, why your employees are targets on work devices, and the one instinct that outlasts the tournament.