Blog

First-person notes from Mac Clark on protecting public websites. Guides · Count mode · Branded 403 · Solutions · Pricing

WAF Watch: A CVSS 10 WordPress upload flaw, Ninja Forms hidden admins, a Drupal advisory pile-up

(opens in a new tab)Mac Clark (opens in a new tab) · October 12, 2026

Weekly WAF Watch for campus and agency operators — Bricksforge CVE-2026-85097 is exploited for unauthenticated PHP upload, a Ninja Forms XSS campaign plants hidden administrators, Drupal ships 26 contrib advisories including a highly critical Block AJAX flaw, and ransomware takes a university’s website offline. Count first, then promote what’s safe to block.

WAF Watch: A campus WordPress web shell, self-healing backdoors, FortiMail file writes

(opens in a new tab)Mac Clark (opens in a new tab) · October 5, 2026

Weekly WAF Watch for campus and agency operators — UNMC rebuilds a WordPress environment after web shells, Sucuri’s SC backdoor reinstalls itself from eight places, FortiMail CVE-2026-104286 is exploited with fixes still pending, and DTU loses identity data to stolen credentials. Count first, then promote what’s safe to block.

WAF Watch: PeopleSoft path tricks, WordPress LFI, Drupal Webform

(opens in a new tab)Mac Clark (opens in a new tab) · September 28, 2026

Weekly WAF Watch for campus and agency operators — ShinyHunters bypasses literal PeopleSoft WAF path rules with percent-encoding, WordPress CVE-2026-87902 actively exploited hours after 7.1.2, Drupal Webform and contrib modules patched Sept 23, and FBIjobs.gov offline under investigation. Count first, then promote what’s safe to block.

WAF Watch: Click2Shell, Feide DDoS, Magento cleanup

(opens in a new tab)Mac Clark (opens in a new tab) · September 21, 2026

Weekly WAF Watch for campus and agency operators — WordPress Click2Shell fixed in 7.1.1, Norway’s Feide/Sikt DDoS wave hitting shared higher-ed login, Magento StyleSmuggler remediation that goes past the hotfix, and a second Events Calendar RCE patch target. Count first, then promote what’s safe to block.

WAF Watch: WooCommerce webshells, Drupal CKEditor, campus SAML

(opens in a new tab)Mac Clark (opens in a new tab) · September 16, 2026

Mid-week WAF Watch catch-up for campus and agency operators — WooCommerce Wholesale Lead Capture webshell campaign (CVE-2026-27540), Drupal core CKEditor XSS (SA-CORE-2026-013), and a miniOrange SAML SSO advisory batch. Count first, then promote what’s safe to block.

WAF Watch: Events Calendar RCE, Elementor uploads, Drupal table field

(opens in a new tab)Mac Clark (opens in a new tab) · September 14, 2026

Weekly WAF Watch for campus and agency operators — The Events Calendar unauthenticated RCE, Elementor Pro form-upload exploitation, Drupal Ultimate Table Field access bypass, and a Berkeley EECS outage lesson. Count first, then promote what’s safe to block.

WAF Watch: Magento zero-day, school-year outages, and Drupal XSS

(opens in a new tab)Mac Clark (opens in a new tab) · September 8, 2026

Weekly WAF Watch for campus and agency operators — StyleSmuggler Magento RCE, France education outages, Drupal Monster Menus XSS, and Feide login floods. Count first, then promote what’s safe to block.

WAF Watch: WordPress RCEs and campus login floods

(opens in a new tab)Mac Clark (opens in a new tab) · September 4, 2026

Roundup of WordPress XSS2Shell, Imagick RCE, Elementor Pro upload RCE, and Norway Digdir/Sikt DDoS — plus a count-mode tip for campus and agency sites.

A client was taking 90 million requests an hour. The WAF was only half the fight.

(opens in a new tab)Mac Clark (opens in a new tab) · September 3, 2026

First-person account of a request flood on a client's public site and a second customer-facing portal — 90 million requests an hour, origin bypass, and what actually stopped it.