How Patchstack Approaches WordPress Security ![rw-book-cover](https://i.ytimg.com/vi/3jw179w8_kI/maxresdefault.jpg?sqp=-oaymwEoCIAKENAF8quKqQMcGADwAQH4AbYIgAK4CIoCDAgAEAEYZSBlKGUwDw==&rs=AOn4CLDQfvSPf1H1NEHrBfo6t_buE9AkiQ) ## Metadata - Author: [[WP Minute Podcasts]] - Full Title: How Patchstack Approaches WordPress Security - Category: #articles - Document Note: --- tags: - #wordpress - #security - #patchstack - #cra - #vulnerability - #ospo Author: Matt Medeiros (host); Guest: Oliver Sild (CEO, Patchstack) Source: The WP Minute (YouTube podcast) Reference: https://www.youtube.com/watch?v=3jw179w8_kI date created: 2025-09-23 11:00 --- # 🔐 Title: How Patchstack Approaches WordPress Security — CRA, AI Risk, and Practical Mitigations ## 🗂️ Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [⏱️ 00:06 — Sponsor & Educational Framing](#️-0006--sponsor--educational-framing) - [⏱️ 02:11 — Patchstack’s Pivot to Research](#️-0211--patchstacks-pivot-to-research) - [⏱️ 06:37 — Update Culture & Delay](#️-0637--update-culture--delay) - [⏱️ 08:39 — 30% Unpatched & Abandonware](#️-0839--30-unpatched--abandonware) - [⏱️ 10:03 — Maintainers Missing; Cleanup Event](#️-1003--maintainers-missing-cleanup-event) - [⏱️ 12:33 — AI-Generated Plugins Spike](#️-1233--ai-generated-plugins-spike) - [⏱️ 14:36 — AI “Fixes” That Break Apps](#️-1436--ai-fixes-that-break-apps) - [⏱️ 16:53 — Exploit Automation & Weaponization](#️-1653--exploit-automation--weaponization) - [⏱️ 18:20 — API Key Exposure Anecdote](#️-1820--api-key-exposure-anecdote) - [⏱️ 19:55 — Economics: AI Apps vs CMS](#️-1955--economics-ai-apps-vs-cms) - [⏱️ 23:07 — Users Don’t Want to Build Sites](#️-2307--users-dont-want-to-build-sites) - [⏱️ 24:50 — Patchstack for Agencies](#️-2450--patchstack-for-agencies) - [⏱️ 28:22 — Partnerships & “Patch Alliance”](#️-2822--partnerships--patch-alliance) - [⏱️ 31:16 — CRA Primer: VDP, SBOM, CE Mark](#️-3116--cra-primer-vdp-sbom-ce-mark) - [⏱️ 33:41 — Legal Exposure & Accessibility Parallels](#️-3341--legal-exposure--accessibility-parallels) - [⏱️ 35:26 — CRA Timeline & First Obligations](#️-3526--cra-timeline--first-obligations) - [⏱️ 38:51 — MVDP, EU Support, Free Onramp](#️-3851--mvdp-eu-support-free-onramp) - [⏱️ 40:29 — Choose CRA-Ready Plugins](#️-4029--choose-craready-plugins) - [⏱️ 43:50 — “Secure Hosting” Isn’t Enough](#️-4350--secure-hosting-isnt-enough) - [⏱️ 45:29 — 87.8% Bypass to App Layer](#️-4529--878-bypass-to-app-layer) - [⏱️ 49:04 — Why Hackers Compromise Sites](#️-4904--why-hackers-compromise-sites) - [⏱️ 50:49 — Stealthy Persistence & SEO Spam](#️-5049--stealthy-persistence--seo-spam) - [⏱️ 54:11 — Wrap & Calls to Action](#️-5411--wrap--calls-to-action) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🧭 DARVO Analysis](#-darvo-analysis) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) ### 📚 References: Include a list of sources consulted and cited in the article. See [📖 References](#-references). --- ## 📝 Summary - **Thesis:** WordPress risk concentrates in third-party plugins and lagging updates. Application-layer defenses and responsible disclosure materially reduce exposure. - **Patchstack’s role:** Vulnerability intelligence, virtual patching (rules per vuln), and managed vulnerability disclosure (MVDP). - **CRA impact:** Agencies and plugin vendors must formalize VDPs, maintain SBOMs, and notify users—treating software like any CE-marked product. - **AI era:** More plugins, faster exploits. Security posture must assume rapid weaponization and abandoned components. --- ## 📖 Main Content - **From all-in-one to intel:** Patchstack shifted to research and coordinated disclosure, partnering with security vendors and hosts. - **Reality of updates:** Fear of breakage, slow patch cycles, and unmaintained plugins keep sites exposed. - **Defense focus:** Network firewalls ≠ app security. Virtual patching buys time to update safely. - **Regulatory turn:** CRA pushes baseline hygiene—VDP, SBOM, user notice—affecting agencies, vendors, and hosts that serve EU users. --- ## 🗒️ Notes ### [⏱️ 00:06 — Sponsor & Educational Framing](https://www.youtube.com/watch?v=3jw179w8_kI&t=6) - 🧭 **Set-up:** WP Minute refuses pure pitches; sponsorship must deliver education. - 🎯 **Focus:** WordPress security, Patchstack research, and practical value for agencies. ### [⏱️ 02:11 — Patchstack’s Pivot to Research](https://www.youtube.com/watch?v=3jw179w8_kI&t=131) - 🔄 **History:** Pivoted ~4 years ago from “WebARX” all-in-one to research/threat intel. - 🧪 **Team:** ~Half researchers (bounties, pentests). Thousands of CVEs processed. - 🧰 **Product stance:** Solve root cause (plugin vulns + slow updates), not only symptoms. ### [⏱️ 06:37 — Update Culture & Delay](https://www.youtube.com/watch?v=3jw179w8_kI&t=397) - ⏳ **Latency:** Average patch lags run **months** across software. - 😬 **Auto-update fear:** Agencies defaulted to turning it **off** for years, fearing breakage. - 🧨 **Risk:** Delay widens the **exploit window**. ### [⏱️ 08:39 — 30% Unpatched & Abandonware](https://www.youtube.com/watch?v=3jw179w8_kI&t=519) - 📉 **Stat claim:** ~**30%** of plugin/theme vulns never receive a patch. - 🪦 **Outcome:** Sites can be “fully updated” yet still vulnerable if vendors never fix. - 🚨 **User blind spot:** WP dashboards show “up to date,” masking unresolved risk. ### [⏱️ 10:03 — Maintainers Missing; Cleanup Event](https://www.youtube.com/watch?v=3jw179w8_kI&t=603) - 🕳️ **Contact gaps:** Researchers can’t reach some devs; disclosures go stale. - 🧹 **Cleanup:** Patchstack targeted low-install plugins; ~**1,000** closures in a month. - 🧱 **Barrier:** Once public, vulns get exploited **fast**; late vendor reactions aren’t enough. ### [⏱️ 12:33 — AI-Generated Plugins Spike](https://www.youtube.com/watch?v=3jw179w8_kI&t=753) - ⚙️ **Trend:** AI kits churn out plugins; submission volumes climb. - 🧩 **Problem:** Authors lack skills to remediate security findings on AI-generated code. ### [⏱️ 14:36 — AI “Fixes” That Break Apps](https://www.youtube.com/watch?v=3jw179w8_kI&t=876) - 🧯 **Anecdote:** In tests, an LLM “fixed” vulns by **commenting out** code—removes bug, breaks app. - 🔁 **Lesson:** AI must be supervised; audits and tests remain non-negotiable. ### [⏱️ 16:53 — Exploit Automation & Weaponization](https://www.youtube.com/watch?v=3jw179w8_kI&t=1013) - 🛠️ **Dual use:** The same AI that finds bugs writes exploits. - 🕒 **Speed:** Weaponization now measured in **minutes/hours**, not days. - 🧩 **Implication:** No team updates 100% of sites within **30 minutes** of release. ### [⏱️ 18:20 — API Key Exposure Anecdote](https://www.youtube.com/watch?v=3jw179w8_kI&t=1100) - 🔑 **Leak:** Public key misuse led to unexpected charges. - 🧽 **Mitigation:** Revoke/rotate keys; many users won’t notice fast enough. - 📋 **Practice:** Secrets scanning and repo hygiene are table stakes. ### [⏱️ 19:55 — Economics: AI Apps vs CMS](https://www.youtube.com/watch?v=3jw179w8_kI&t=1195) - 💸 **Cost reality:** LLM tokens for edits/bugfixes accumulate; CMS often cheaper. - 🧰 **Advice:** Prefer WooCommerce/WordPress where it fits; reduce bespoke risk. ### [⏱️ 23:07 — Users Don’t Want to Build Sites](https://www.youtube.com/watch?v=3jw179w8_kI&t=1387) - 🧑‍💼 **Market truth:** Most users hire agencies; DIY is not the median desire. - 🧩 **Agency calculus:** “VIP code everything” with AI is costly to build and maintain. ### [⏱️ 24:50 — Patchstack for Agencies](https://www.youtube.com/watch?v=3jw179w8_kI&t=1490) - 🧱 **Scope:** Patchstack focuses on **WordPress-specific** vulns (logic flaws, option changes). - 🔁 **Care plans:** Bake security into retainers; **virtual patching** buys safe update time. - 🤝 **Hosts:** SMBs often get Patchstack via hosting partners. ### [⏱️ 28:22 — Partnerships & “Patch Alliance”](https://www.youtube.com/watch?v=3jw179w8_kI&t=1702) - 🤝 **Collab:** Partners with Sucuri, Solid Security, Defender, many hosts. - 🛡️ **Alliance:** Threat intel sharing across “competito - Summary: Thanks Pressable for supporting the podcast! What hosting should feel like...nothing! https://pressable.com/wpminute  n this episode of The WP Minute+ podcast, Matt Medeiros speaks with Oliver Sild from Patchstack about the evolution of WordPress security, the challenges of managing plugin vulnerabilities, and the implications of the Cyber Resilience Act. They discuss the role of AI in development, the importance of vulnerability management, and how hosting security measures often fail to protect against exploits. Oliver emphasizes the importance of compliance and proactive security measures in the WordPress ecosystem. Takeaways: • Patchstack has evolved from a simple scanning tool to a leader in WordPress security research. • Half of the team at Patchstack focuses on security research and vulnerability management. • 30% of security vulnerabilities in plugins are not patched in time. • The Cyber Resilience Act will require compliance for digital products sold in Europe. • Vulnerability management will become mandatory for agencies and plugin developers. • AI is being used to create plugins, but it also poses security risks. • Many websites are hacked without the owners’ knowledge. • Hosting security measures often fail to protect against application-level vulnerabilities. • Patchstack provides a managed vulnerability disclosure program for plugin developers. • Continuous maintenance is essential for WordPress websites. Important Links: • The WP Minute+ Podcast: thewpminute.com/subscribe (https://thewpminute.com/subscribe) • Patchstack (https://patchstack.com/) • Connect with Oliver Sild: LinkedIn (https://www.linkedin.com/in/oliversild/) | Twitter/X (https://twitter.com/oliversild) Support our work at https://thewpminute.com/support Get the newsletter at https://thewpminute.com/subscribe ★ Support this podcast ★ (https://buymeacoffee.com/mattreport) - URL: https://www.youtube.com/watch?v=3jw179w8_kI This episode of the WP Minute is brought to you by Pressible. You know what the best hosting feels like? Nothing. No panic alerts. No mystery downtime. No, hey, is the site down? Slack messages. That's the pressable experience. WordPress hosting so reliable you forget it's even there. We keep your site fast, secure, and up 100% of the time so you can get back to building, selling, blogging, or binging cat videos. No judgment. Whatever you want to do, go to pressible.com/wpmin and try hosting that disappears in all the right ways. Pressible.com/wpmin. pressible.com/wpmin. Thanks pressible for supporting the show. Hey everybody, welcome to the WP Minute. Today's special guest, Oliver from Patch Stack. Oliver, welcome. Hello. Happy to be here. Uh gotta get I gotta get the the housekeeping out of the way. Pashtak is a fantastic sponsor of the WP Minute. We couldn't do it without them. Uh but they are joined today. Uh I was chatting with the team. We're like when we do sponsorships we have to bring like core value to the audience. We're talking about like you know people knock on the door to sponsor the WP minute like hey can we just pitch our product? We're like no no you can't do that. You have to have some educational value. is what we try to do here at the WP Minute is get people educated. And I was talking to your team, there was like, well, we have like a a zillion things that we can we can teach your audience. Uh, one of them, uh, of course, is the Cyber Resilience Act, which I'll be honest, I know very little about. Um, I'm not an agency owner anymore, but we have a lot of agency owners in the crowd. And uh we can touch upon that and get people ready to understand like what they should be thinking about um when when faced with trying to understand this stuff. But you all have some new research out. I mean you have stuff coming out all the time. Uh so I'm sure this will be uh a wealth of knowledge. PatchStack is the dominant force for what I would say WordPress security um information product scanning all of the stuff that agency owners and WordPress owners should be aware of. Oliver, where have you seen PatchStack evolve the most over the last couple of years? um you know from simple scanning to now like leading the pack of like saying hey we have research we're trying to understand threats and awareness for WordPress I would say one of the big things that we did so four years ago we actually did a pivot right um before that we were called web arcs uh and then we were kind of like in the path of building like an all-in-one kind of like a security product and which is a very I would say common thing happening in the WordPress ecosystem is like everyone ends up building some all-in-one solutions because that's the demand, right? Like customers want everything uh and in many cases pay nothing. Uh that's the kind of like the moto, right? Um so we really like took like a really kind of like a reflection time for ourselves and look into like what we do the best is one of the thing and then also like what like really needs to be solved on this ecosystem. Um and we ultimately realized that you know first of all we do really good security research like half of our team is literally you know security nerds doing research uh you know we've been doing bug bounties uh we've been you know being doing pen testing you know stuff that stuff like that. So that is that is like our kind of like a you know uh that's our jam right. Um and then the second thing that we would kind of looked into is like over the years like even even last year like when we did uh a research together with Sukuri um like half a million websites are getting hacked every year right that's a lot of websites getting hacked and why is this happening if we have you know all sorts of you know security products on the market doing malware scanning you know doing um you know firewalls whatnot and we're still facing the same Um so we're like okay let's try to instead of like I would say like uh cure the uh symptoms right um let's try to like really dive into like what is the root problem there um and you know ultimately you end up with people not updating their stuff and those unupdated stuff have a lot of vulnerabilities in them so specifically security vulnerabilities in plugins that are developed by uh you know different uh different plug-in developers ers which are you know uh quite often riddled with vulnerabilities that the that the users of WordPress uh are not necessarily patching in time and hackers are taking advantage of it. So I would say that has been really the core focus of patch stack. Uh we've gone like really heavily into vulnerability kind of like research threat intelligence on that regard. We've partnered up with Google. We created an AI based code review tool that is finding vulnerabilities on its own on the you know WordPress plugins. Um this year alone I would say we've I think uh processed around almost 5,000 CVS already. Uh that's like 5,000 new security vulnerabilities that have been reported exclusively to patch. I would say around 75% of all known security vulnerabilities in the WordPress ecosystem are originally reported to patch through our bug bounty program. And then what we created also is the managed vulnerability disclosure program uh that now dives a little bit into this cyber resilience act direction but this is essentially a platform for plug-in developers uh to stay compliant and to make their code more secure. So a lot of the security reports also go through that. I have a ton of questions about like baseline security for WordPress where just over halfway through 2025. Yeah, I used to work at a company called Pagley before it was acquired by GoDaddy. Uh just as an account executive. I was not a uh security specialist or on the infrastructure team at all. Uh but we had a lot of discussions with customers and clients. It was like top priority for them. And this goes back, you know, six, seven years ago. You know, I'm wondering for the for the the user out there who's listening to this going, haven't they just solved, you know, patching plugins automatically? Isn't this a thing of the past? Um it it why haven't we gone beyond uh that point already? Do some hosts require users to still update manually? Is that a business for them to be like, "Hey, if you get this plan, you have auto updates." I thought here in 2025, everyone knew to keep their stuff updated. What do you see on on your side? And and is there one thing like people should just be doing besides clicking that update button? So, you know, this is not only a WordPress problem, right? This is not WordPress specific problem like when you're looking into the statistics even on the enterprise market where you have complex cy like complex infrastructure IT systems things like that the average time it takes uh for a for a software vulnerability to be patched in a system is like 3 months right uh this is a really really long time uh and you know hackers know about it so they take advantage of it right you remember when uh WordPress just released the feature to enable out updates on plugins, right? The first thing that you saw on blogs on you know if you googled about this like the blogs didn't talk about this new amazing functionality like you know you can now auto update plugins every blog post was like how to turn this off how to make sure that the out updates are turned off like literally when we when like we I I remember you know laughing about it it's actually kind of sad but I did you know find it funny is like when it was rolled out like every single post like everyone was talking about how to turn it off, how to make sure that the customers don't enable it, you know, accidentally and things like that. And the reasoning is behind, you know, the like I think there's some mistrust in the plugins that people have been using historically and you know, them maybe breaking the sites and things like that. So, um I guess like agencies are a little bit freaked out about uh you know having those updates being done automatically and then maybe maybe there's something that it's it's not even about whether it actually breaks something. It's the fear of maybe it breaks something. Um and and that that is that is ultimately one of those problems, right? That's why people are not keeping them updated. And and another statistics that I would add here is that when we've done so every year we are releasing this state of WordPress security report for the past two years we've been doing it in partnership with go uh with uh Sukuri and around 30% of the security vulnerabilities found in plugins and you know and themes 30% uh so 30% is not getting a patch. So in 30% of the times you don't even have the ability to update anything. Uh your like we know that there is a security vulnerability on a plug-in but when you go and uh log into your WordPress install and look into the list of plugins you see everything is up to date. Um and of course then there's also the problem of all the abandoned plugins um which is a which is a separate problem in its own. Is this is the is that lag or that 30% number do you think that's specific to um WordPress or perhaps maybe you're only researching WordPress and other CMSs, but is that specific to WordPress because people come in, they build a theme or a plugin, uh they try to make a go at it as a business and they just can't do it and then they kind of abandon it and user doesn't know because there's no relationship. How much of that is happening where people just kind of like give up on that plugin or theme and now it's just left to just I guess lack of a better word get exploited over the years. Is that is that a big thing or is it just they're not doing it right a majority of them? So a lot of them are just like you know they are um you report the vulnerability to them they don't respond for a long time uh they don't really I guess care about it or they don't even have a place where to contact them and then you know we also have responsibility in front of the security researchers who are reporting those vulnerabilities and also to let the customers know that they have a vulnerability that has been going unpatched. So once you make it public and when they find out about it somewhere then they might react in a week or two you know but like when a vulnerability is already published hackers are seeing it immediately so they can go after and you know start exploiting those websites because they know that the customers have no idea about that right um and then there's this other group of vulnerabilities where uh the developer is is basically missing right so it's a plug-in that has been added to the repository some time ago maybe it's a really simple function funality that you that that is getting added on the website. Uh but you know the developer built it maybe five you know 6 10 years ago. Um and s and it could be that it became you know it suddenly become a popular plug-in like 3 years ago but that was already you know after the developer like left and started working on some other stuff and things like that. So ultimately the plug-in gets abandoned and then this plug-in also gets uh closed down. Last year in October, we did like a WordPress ecosystem like a cleanup event uh where we literally looked into plugins that have low install counts uh and then we're looking for vulnerabilities there just in intentionally to see like how many of those plugins are not going to get patched at all and whether they are abandoned or not. And we closed down I think like 1,000 plugins in a month which were like you know they never received a patch. they still haven't received a patch and the developers have already, you know, gone to do something else. Um, so I think there's still quite a lot of those plugins in the repository that are completely abandoned that have like, you know, maybe 1,000 active installations, but when you're counting all of those abandoned plugins together, uh, having, you know, that they have, you know, critical security vulnerabilities, hackers can just, you know, go after them. The users cannot do anything about it, uh, with updates. I don't want to accelerate the conversation immediately into AI because that's a whole that's a whole thing. But I I mean I just tested out and and published on the YouTube channel uh automatics recently announced uh Telix application where you chatbot and you can build uh uh uh blocks uh or I guess many plugins. I built a little thing that connected up to just as a as an experiment API over to Pixels to pull images in from the Pixels photo repository. Really cool. as a power user, I'm like, "Oh, yeah. I like this stuff." But then immediately in my head, I'm thinking, "Oh my god, anybody can build any software and just run this on their site." And now you're you're just going to have the common person who's just like, "I need this functionality. Connect to Facebook to do this thing." And then next thing you know, like something is happening and code is really bad. Um, that's like that's I mean I can't even imagine to to to think about how to analyze uh research and and thwart those kinds of threats when it's not even like a bad actor. It's just somebody who doesn't know what they're doing with code on their own site. Um, what what are your thoughts about like protecting the user at that level? I think uh I think Matt also shared like some statistics about the amount of plug-in submissions that uh that the thatorg is getting. I think there's yeah so I don't remember what the number was like 78% increase or something like that um because of AI there's like just so many new plugins being you know added into the repository. We've talked to people in the community who have like you know there's like kits to basically use with AI to build plugins and things like that. So you know so many of the new plugins that are being added into the repository generated by AI. Now the question is like once once we identify a security vulnerability in one of those plugins which we continuously do uh like we already find vulnerabilities uh in those plugins and quite a lot in Frank uh the the problem is that the developer who used this who used AI to build those plugins they have no idea how to fix those vulnerabilities. Yeah. uh well they can ask AI to fix it but that's you know not often uh a very very like I have I always tell a good story that uh when I was in the uh Google uh Google engineering offices in Min um we were like uh with the so with the Gemini's uh security team there and they were like okay they were trying to use Gemini and they have like uh this uh big uh uh they have like basically like a sec elemment like there's LM L&M for like security and they were trying to like whether AI can uh fix security vulnerabilities, right? So they were like okay let's make a test like you know we have a vulnerable software let's ask AI to basically fix that vulnerability and then they ran a benchmark of like okay does this now have still the vulnerability or doesn't and then they saw that okay AI was capable of removing the vulnerability in like uh quite a high percentage of times but then when they started looking into it what AI did was it just commented out code so it literally you know it's what do it it broke the application uh just to not make it vulnerable Uh but you know that's that would obviously cause you know uh a bunch of other other problems. Um but the thing with AI is yeah obviously the number of vulnerabilities going up um is quite significant. Uh but there's I would say even a bigger problem is the fact that uh AI is also available for the hackers. You can like we have a solution internal like patch has a system uh which is basically like we take a WordPress zip file uh we run it into a system. there's like a multi-level process with different AI modules including it basically builds a whole context of that application and then uh looks how the data flows within the within the code base in through multiple layers and then figuring out like whether there is like vulnerabilities anywhere in the codebase and it does the for the entire uh plug-in in one go. These kind of solutions are available also for the hackers to basically scan you know potentially through well it's going to be expensive with AI but they can in pract in in theory like scan through the entire WordPress you know repository to find those security vulnerabilities and then also use the same AI to write exploitation scripts and now this is a big problem because um in the past um the hackers that were the fastest were the ones that were the most skilled they found a new vulnerability and and they quickly wrote an exploit script to basically hack as many websites before the users had time to update that barrier is now gone. any script kitty that can you know follow vulnerability databases anything like that they're like okay this this plug-in this version has a vulnerability give that I don't know vulnerabilities like a CV to that to AI and tell like hey can you write me a can you find the vulnerability where it was specifically and can you write me an exploitation script to basically you know test my systems but like you know actually it's a full-blown exploitation script they can go and you know um weaponize it in So short time like we're already seeing that the vulnerabilities are weaponized in a matter of hours sometimes in 30 minutes. So now this time is getting even shorter and please show me one agency who after a plug-in is receiving an update goes and updates everything in 30 minutes. Yeah. Nobody does that. So that's that's the challenge that we are going to face or facing already. Yeah. Yeah. And I I would say like obviously the broader scope, right? Because anyone who's launching well like a person like me, Bolt, Replet, like we're just building JavaScript apps now that are just whatever we want and it just we're not even doing the working in the confines of WordPress anymore. Like I'm able to build these things and just the other day I I I was uh away last week and every day I was getting it like you know it's one of those things where I I get an email and it's uh from the Open AI API and it's like oh your account's been funded. So I'm like, "Okay, so like five bucks." And then like the next day your account's been funded five bucks. I'm like, "What?" Because I built this I built this app that reads a bunch of WordPress news sites and aggregates it and summarizes it. So I'm like, "Oh, it must be a lot of news happening, right?" So then it's like the next day, your account's been funded again for five bucks. I'm like, "How much is my API key being processed uh for for PulseW?" So I I log in to my open AI uh API console and it's just like all these image requests coming through for my API key and I'm like I I'm not the one making these image requests. This my app does not do this. So somewhere along the line I built something and the API key was left out into the public somewhere and somebody was abusing it. Now it's easy because I could just I just delete that API key. I mean, I was just like, "Okay, that's how I found it. Like, that's how I mitigated it." But there's going to be a lot of people who don't know that and can't make like these these decisions. And yeah, I mean, no real question, but it's just like that's the world we're headed into, I think, with AI. And I've seen it with Rep like they have a security scanning thing, but you know, who's going to do that? I mean, I I don't think many people are going to do that when they're playing around with this stuff. For sure. Yeah. I mean in in general like the cost of using AI to build simple websites is ultimately going to be greater than just slap a CMS on it right you know right uh people don't realize that but like you're building an application with AI uh and then the cost of like doing every edit like you're you have to consume LLM and the resources for every single edit you want to make on this website uh for every bug bug fix you know every time you're paying those LLM credits uh and in I we we are running those uh AI meetups here in the co-working space where I am right now and people are like they like they try to build an e-commerce website with like lovable and with v Vzero and stuff like that and they're like it's going to get like so expensive like they're like I wish I just use a WooCommerce site and just you know slap it into VCommerce host it somewhere pay just like a monthly fee for the hosting and you know that's it right um so at one point we are getting to a to a question you So that's a little bit of away now from the topic of security, but like um should we vip code everything? Uh and maybe maybe it makes sense to just use something that is already working out of the box and we don't need to reinvent the wheel every single time and actually spend insane amount of compute. Yeah. To to do it all over again. So it's like really unefficient. Yeah. Yeah. No, I I I'm 100% there with you. And I think that might be one of the like one of the things that I'm always trying to do is like how are we like still supporting WordPress the project like how are we still making sure that people want to use this tool whether it's for like the blog side of it like hey I just want to be an end user I want to publish words or I'm a developer I want to build sites or solutions for clients and you know I I think that myself included everyone's so excited about AI but when you start to spend the cycles like the mental cycles of building a a piece of software I think this might The one good thing that comes out of this or one of the many good things that comes out of this is people realize, oh yeah, it's not as easy to do it. Like, oh, version one was great. Like your immediate MVP was like, oh, look how awesome that was. But then you had to like fine-tune it and get it right and like ship it so that it worked and you're like, this took forever. Like I spent a ton of of tokens and this took forever. Now, who the hell is going to fix it when I need another feature? And I think what people I hope people do is like you said, like Woo Commerce is right here. why didn't I just use this, right? And you start to you realize like, oh, that was nice. And then you have people who can actually come and help you when you're getting stuck. Because with AI, it's like when you get stuck, you're like basically like, you know, you have to find an I don't know, like a JavaScript engineer who is then going to untangle the entire mess and then figure out like where where something went wrong. Um so it's yeah it it is definitely you know a tricky one uh to solve and I think it creates a lot of um a lot of uh technical depth and I think ultimately the question also is like this is something that has always been coming back like I remember 5 years ago everyone's like like yeah but like who cares about WordPress like you have Wix and you know Shopify and things like that we've already been through that with WordPress right PHP has been dead for the past 20 years uh like you know it's kind of the same thing And like uh and the thing with Wix and Shopify and things like that and then where people are still shocked why people continue to use WordPress is the fact that the main misconception is that people think that people want to build their own websites. Yeah. Nobody people don't want to build their own websites. That's why we have agencies. uh you know and the question is like whether agencies are now going to use you know AI to VIP code stuff because you know to build up something for their customer that's a really tricky question because it's going to be so much more expensive for an agency to build customer an e-commerce store uh by wipe coding it and spending tons of money on LLM compared to using something that they already know very well and they can get a stable product out which requires less maintenance actually than uh later figuring out like all the all the tangled mess that the LLM created. Um so I think that a market dynamic that we need to take into account here as well with when it comes to AI and also the security side right because we know the challenges the security challenges of WordPress you know we know about that but when we think about like wipe coded applications like the the security challenges of a vcoded application is a black box like anything can come and jump out of it uh you know any minute that you're not prepared for. Um, yeah. Yeah, it's good business for Patchack, though. You'll have plenty of plenty of customers knocking on the door. Um, speaking of customers, uh, for the agencies and the freelancers out there listening, where does Pashtack sit in um, uh, the solution uh, for these types of customers? If we go to patchack.com/pricing, we can see it starts off at $69 a month, built annually, 25 websites. To me, this says, "Hey, we we're for the professional. We're for the freelancer who's got a bunch of clients. We're for the agency that's got a bunch of clients." This isn't just I'm a, you know, a pizza shop and I have a website for my pizza store and I just need security. I mean, I'm I'm sure they could pay the 70 bucks, but I think this is geared more towards that freelancer or agency. How do you want somebody to on board to that experience? Like what should they be thinking when they deploy this against their portfolio of sites? So patch tech is used by agencies and freelancers quite a lot to essentially and also like developers um to cover the uh vulnerabilities in the WordPress application itself. You know hosting companies they cover uh you know with the DNS firewalls like Cloudflare and things like that they cover like they make sure that you know some bots are not taking your site down with like you know insane amount of requests like DOS attacks and stuff like that or just like kind of like filtering out like some spam and things like that. So patch tech specifically focuses on providing uh the fastest protection uh to WordPress specific vulnerabilities which web application firewalls and hosting level security solutions are blind to. Um and what agencies do is they you know they you can just go and sign up to the developer plan and you can kind of very quickly connect WordPress sites with it and then uh very common use case is to basically include the the security into your care plans. We really recommend host like all agencies actually to basically offer maintenance and care plans to their customers because that is first of all commercially one of the best ideas to kind of generate recurring revenue. But this is insanely needed for everyone who has a WordPress site because continuous maintenance is something that everyone needs when they have a WordPress website. And if you know if you don't want to like I don't know stress out every every night like oh my god like you know can I go to sleep because maybe 1:00 a.m. in the morning one of the plugins is releasing a an update that includes a security fix and then I need to like quickly go and you know update it. What patch does is that we are actually for every single vulnerability that is getting published in the world we create custom crafted security rules for it. So when a vulnerability is found in an update uh that is u released in a plug-in we can automatically mitigate that without any action uh needed from the agency. So they can wait to update whenever they want to actually update without leaving the website exposed. And that is the main benefit of patch essentially. And then we work with a lot of hosting companies right like one of the one of the core focus for patch techch is actually hosting partnership and different partnerships with you know products like um you know WP umbrella for example uh many many different hosting companies that we work with pageely included that you mentioned uh where uh patcha can be uh re like that is the place where if you just have like a little bakery or pizza shop whatever um and you just have one website then the place where you should get patch is through your hosted provider. There's no need for you to like have a full-blown patch kind of like you know account and you know the dashboard and you know all the bells and whistles. You can just go to your hosting company pay you know $2 a month and your website is protected. Um so that is how we've kind of like approached it. We have a full security suit for agencies and then we do very deep integrations with hosting companies to provide that level of protection on scale and then those who have like just a single website or whatever uh they can get patch uh through the hosting provider that they're already using um just to make life a lot easier for everyone and kind of like make sure patch is available uh and accessible as well as possible. You mentioned before uh that you've done some partnership work with or worked together with Sakuri before. Um from the from from my standpoint from the sidelines maybe I missed the memo are aren't you guys competitors like how does that work or is it just a shared knowledge of hey just like we share knowledge in WordPress you're sharing knowledge in security. Is that what is that what that is? So that's the beauty of uh patch tech in the sense where we we decided to not be allin-one solution and we decided like we're like really go and bang on this one problem like we are going to do like the best threat intelligence in the ecosystem. We obviously are controlling basically the data flow of all the security vulnerabilities. So we just cover like this one lane, right? So we just like we know about the vulnerabilities before anyone else and that allows us to protect the customers from vulnerabilities before anyone else as well. At the same time, we don't want to do any of the malware scanning stuff. We don't want to do any of the I don't know like uh generic kind of like IP blocking reputation stuff that you know DNS firewalls and things like that do. So that kind of leaves a door open for us to partner up with other security companies that do all these kind of things. So for example with Sukuri we are in the partnership I the security solid security they are we are in partnership with them it's powered by patch stack WPMU defender powered by patch decks we are kind of like building this found foundational layer of uh protecting WordPress websites from plug-in vulnerabilities which happens to be you know the main way how WordPress websites are getting hacked and so we want to just make this available across the ecosystem as widely as possible and I honestly believe that the only way to do that is through very deep partnerships. Um, and that partnerships include also uh partnering with uh uh with someone that you know others may consider competitors of ours. In fact, a week ago, we create we announced a uh open um o open web security alliance uh where we basically have invited every stakeholder in the ecosystem who is you know providing hosting who have plugins that are basically powering a lot of different websites uh security companies who are providing security services in the ecosystem. We have created what called like patch alliance where we essentially share the information about the latest threats uh you know the the incidents and things like that. So we can all work together as a community and basically make sure that information gets shared within the ecosystem within all the security teams uh to make all the customers safer. So um this is our approach to trying to make the biggest impact in the ecosystem. Yeah, that makes sense. No, it's a obviously a smart move. Um, towards the end here, I want to talk about the Cyber Resilience Act. Again, going back to my page days, I remember when GDPR was about to become a thing, and it was uh I don't want to say the fish were jumping into the boat, but as a sales guy, people were like, "Hey, we need this. Uh, we need to make sure that we have hosting that supports this." Um, for folks listening who haven't heard about the Cyber Resilient Act yet, how can we just sum it up for the freelancer or small agency owner out there? what does this mean to their day-to-day uh if at all? Yeah. So, one of the first things I'm have to say is like if you remember what happened when GDPR became the thing, what needs to be understood that cyber resilience act is going to be way bigger. uh it is going to impact a lot more uh companies and it is you know with GDPR it's like I can just tell you like oh we're compliant like I don't need to show you anything but I can like say like oh yeah we have like all these data processes internally in place and like we keep the registries and whatnot and like yeah we're totally compliant right which you know we have the cookie notice you know we're fully compliant um which is you know rarely the case with with the cyber resilience act essentially what it does is that whenever if you're selling a digital product uh in which case if you're a digital agency selling a customer a WordPress website that is a digital product and it needs to have a CE mark the same CE mark that you put on physical products that you sell in the European market right um so regardless whether you're American company I don't know wherever you're from if you're selling like it's not even if you're selling your product in Europe if you're making the product available to the European like if if there is an if there is a possibility for a European citizen to buy your product, you need to have uh compliance with the cyber resilience act and like some of the simple way things then comes like vulnerability management uh is mandatory. So whenever there is a security vulnerability found in your digital product that includes all the plugins. So if if you're a plug-in developer uh and there's a security vulnerability in your plug-in, you are uh first of all you need to have vulnerability management in place. You need to have the supply chain security covered. You need to have uh sbombs basically like software build of uh materials that basically it's like an ingredient list of what your software is made of, right? Um you need to have a security point of contact. That's why we created this patch tech MVDP program where over 1,000 plug-in uh plug-in vendors already kind of like have like a patch access their security point of contact. So you need to have all these things kind of set place. Um and then you need to like if there is a security vulnerability found you need to make sure that it's reported into the European vulnerability database. You need to make sure that the customers are always going to be notified when there's a security vulnerability in your product. uh you need to publicly uh you need to make it public that there there is this vulnerability and like all these things are very easily checked from the outside. So now you need to take into account that if you fail in any of those things then in in most of the cases when you have compliances like that coming up the companies that are going to make the most money are law firms right uh and now you need to take into account is that law firms can easily check whether your software is compliant with the cyber resilienc point of like do you have a VDP program this is mandatory if your plug-in does not have a VDP program proper security point of contact then the law firm can just find one user uh of your plug-in and then tell them like we're going to basically make a lawsuit, ask for you know damages and then you know they're going to split whatever the fines they are going to do for the this is already happening with the accessibility act by the way um where people are like you know they they've been damaged by the websites not being accessible and things like that. Law firms are making you know all these lawsuits and then basically they settle and then uh they they are making money and pushing those companies into uh compliance. This is what is going to happen. Uh right now WordPress is completely non-compliant. Uh agencies need to take into account that they need to start having vulnerability management in place for every single website that they're going to sell. Uh plug-in developers need to have VDPs in place and you know the same things. Uh all the security updates need to be separated from functional updates. There's quite a lot of change that WordPress.org or itself needs to do as well to make all of this even possible to for the plug-in developers to stay to become compliant and so forth. And the law was already passed. So the law was passed in October last year. Uh this uh sorry next summer in June the first obligations are kicking in which means that uh the first obligations are basically the obligation of having VDPs and uh if there is a vulnerability you need to you know report vulnerabilities to all customers. So if you're an agency and the website has a plug-in that has that is vulnerable, you need your OB you're um you have an obligation to let the customer know of that vulnerability. Um and then you know uh provide some level of mitigation and and things like that. So vulnerability management is going to become essentially mandatory in that regard. So, and that and the full obligation I think is starting to kick in in somewhere 2027, but we have less than a year to basically for the first ones. And how how has patched stack the product half had to change like or let me ask it this way as trying to not be just like a strong sales pitch for it but like does one just sign up and have an account and all of this stuff is is now taken care of because you have patchack or because I remember with GDPR it wasn't just like oh switch over to Page because Amazon infrastructure you know uh uh Reddis database over here front end over here everything's separated yada yada yada uh there was still work to be done like there was administrative work to be done. Is it as easy as just signing up for patchack and then you're checking a lot of the boxes or there's still a lot of like stuff that these organizations will have to do? So cyber resilience hacked has like types. So there's like uh like based on the importance of the software or like the digital product that you're offering for example if it's a security software and a firewall product for example which is the category that we have which is the highest category then you have the highest amount of compliances. So we started working on our compliance five months ago already without even having like a lot of the information known to us and what we are doing is actually documenting all of our process of us becoming compliant first and it is quite a lot of work like we are going through the hardest like we are like on the hard mode right um so we're going through that uh so there's things that companies need to do themselves as well but we because we've run through this process we've already looked like okay if we need to do those things we need to make sure that our product includes uh uh those uh features that help others who are now going to follow uh getting compliant for them to just basically make that easier right so you know that includes like the entire MVDP platform that we created which was actually co-ounded by European Union as well where plug-in developers can just sign up to it they can add their plugins it immediately gives like a visibility into like all the vulnerabilities found in their plugins uh how it how they are getting it uh you know solved there's a secure channel how vulnerabilities are going to get reported they immediately have the VDP like if you're going if you have a plug-in and you're signing up to batch MVDP which is completely free by the way uh because we we did build it together with European Union then uh uh you are going to be uh compliant for the stage one which is happening June 2026 um so that is the first part to get covered next things that you can do there is to uh keep your sbombs which are going to be required as well things like that so we're adding all of those based on the new law into the platform so plugging developers can get get compliant and then agencies who build WordPress websites as digital products to their customers. They can be compliant when they are using patch tag uh install it on their customers and then the customers can get notified about the vulnerabilities and so forth. So that's basically how we are kind of like building it up to support uh the the shift that is happening on the ecosystem because of the cyber resilience act. I was also gi g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g given I also gave a talk at work camp Europe um this year about that. So on WordPress.tv I think uh or word camp.tv you can actually see uh my talk as well. So I recommend checking it out as well. Yeah, I'll link that up uh in the show notes. I'm on patchack by the way. patchack.com the footer. This is the best footer I've ever seen in my life because there's so there's you have all these like new updated like number badges for all this stuff. There's so much information uh and stuff in in your footer. If someone goes so I scroll down to the footer, there's the active VDP directory. It says 858 WordPress plugins with active vulnerability disclosure programs. This means that these plugins in this uh uh directory or this database here they're they're what they're sharing the data with you and they're letting you know like oh we found something. So for all these plugins patch is their security point of contact. So you see elementor there for example, right? Y so if anyone in the world finds a security vulnerability in elementor page builder then elementor is saying like great report that to patch. Uh we then process it we make we validate it and then we control the disclosure process for this vulnerability to be published. We help elementor team to basically fix it up and things like that. So if you're for example an elementor user uh then the best security for your website uh to you know keep your website protected is actually coming from patch tech because we always know about elementor vulnerabilities first and that also allows us to essentially uh mitigate those vulnerabilities even before like any other security company becomes aware that there is a security vulnerability in the first place. Um, so there's like, yeah, nearly 1,000 plugins who have already decided to make patchtack their security partner basically for that. Um, so definitely I recommend to first of all check this list for that reason. So if you're using any of those plugins, it might make sense for you to use patch tag to secure your websites as well, but also look at those plugins and think of like, hm, I want the plugins that are in installed on my website to be in the list because that means that they're also CRA compliant because they are already having VTP setup. they are already running uh you know those security processes that are uh kind of like from the from the official guidelines and things like that. So uh hopefully we'll see more and more plugins there. Uh right now we're getting like 100 new plugins every month. So it's quite uh quite active. When the cyber resilience act says that like the phase one the end user needs to have VDP. Is that what this is? They need to be able Okay. Okay. So, this if you're an agency owner, would you apply to the program or would you just say, "No, I I just need to look for these plugins." So, if you're an agency uh and you're building a WordPress application, you need to make sure that the all the software that you're using to build the digital product is compliant with the CRA. So, every plug-in that you as an agency are going to install on a WordPress site, you need to make sure that they are already CRA compliant, right? So these are the this is how it kind of like starts to you know snowball into you know uh if you're like plugging that's why plug-in developers should actually start working on that right now because otherwise customer base because agencies can't use them and then if agencies don't actually do properly vulnerability management and they don't look into the plugins that are have the compliance the agencies are starting to lose customers because uh enterprises who are who want to have a website built, they need to also have their website compliant and they need to ask the agency like, "Hey, do you have an ESPOM for our website? Are all those components that you're using compliant?" You know, it starts to kind of like pile down and that so it's, you know, that's why I'm saying it is going to affect the entire ecosystem. Yeah. Yeah. Yeah. And and like, you know, if if you're an enterprise or a bigger business, like if they're launching a website next year, I mean, it's already started, right? Like, so that plan has probably already started with an agency and they're already thinking like, well, when this launches in the summer of 2026, you know, we're going to need to have this phase one checked off. So, yeah. No, it makes sense. Um, yeah, it's interesting um hearing from you like how much patch stack differentiate differentiates um, you know, against like the all-in-one solutions on information like information and education. Um, you know, that's fantastic. I mean, that was that that's great. Um, where can folks go? Okay, so I'll link up the There was a a hosting report, too. I wanted to pull up uh I think so it's on the it's on the website on there's like a banner on the front page on top of it under the menu bar. Yeah. Yeah. Sources case study. Oh, right here. Yes. Hosting security tested 87.8% of vulnerability exploits bypass hosting defenses. Let's wrap up with this one. How How does 87.8 eight uh of vulnerability exploits bypass hosting defenses. I think a lot of people try to put their trust in fact myself uh put trust in in my host or they not have the right tooling are they not quick enough on the turnaround time like how do we get these hosts to say uh let's get this let's get this defense set up before these exploits happen. So the whole test actually came from the point where everyone is like people are like saying like where actually if if if you search if you if you Google or if you ask AI I don't know AI results are anyways coming from the whatever people have basically written on Google right but like um if you ask like oh give me like five tips how to keep my WordPress site secure number one tip is choose a secure hosting um and that's what a lot of people are ultimately relying on because when then they are look okay I'm going to look for secure hosting and then this hosting company saying like we have firewalls and you know we have you know all the bells and whistle that is coming from security and then the customer is like great I don't need to think about security I'm covered if that would be the case then why do we why are we still in a situation where like half a million WordPress websites are getting hacked a year like it doesn't make sense right um and then I had this like uh argument with Matt Mullen on Twitter where where like he's like yeah but like all these vulnerabilities are already you know covered by hosts on the network layer. I'm like, hm, okay, let's run a test on that because you know what we see is completely different. Uh, in fact, we've been running a honeypot project. So what we did years ago already is like we signed up to every single hosting company that we could look for uh created a registered the domain and installed a WordPress site there and then installed patch tech on it and then occasionally we install vulnerable plugins in it and just to see like what you know what is basically reaching patch tag what is being blocked on a network like on network level hosting level things like that and we just continuously see that basically all the new vulnerabilities like everything hits patch tack which means that all the previous layers have failed right so We're like okay let's do a like uh control test. Let's take different kind of hosting services that use different sort of security products uh you know uh that use Cloudflare in front of every website uh and then let's take to to like not make it biased. Let's take only the most critical vulnerabilities that everyone has seen on the news, right? Like the the very big ones that have been mass exploited. There's been warnings all over the place. there's like news sites talking about those vulnerabilities and let's test whether the attacks against those vulnerabilities are reaching patch or not. Uh because the way how patch works right like we create security rules per vulnerability. We are not like kind of like a pattern based security solution where we're like just trying to weather figure out like hm this looks like an attack right so we don't do this kind of thing like we have every vulnerability that is added into our database we're going to create the create the security rule just specific to it right so we ran those tests and then what we realized is that like you know what the percentage was like almost 88% of those vulnerabilities just go straight through there's like multiple layers of defenses on you know deployed on the hosting level cloudflare in on front of it and there's like you know solutions like Immunifi and whatnot in the middle of it. Uh and then you know they still like we were able to exploit the vulnerabilities on those websites and gain full site control um you know without patch installed. And what essentially that showed us is that the vulnerabilities, the most dangerous vulnerabilities uh that are WordPress specific logic flaws that allow you to basically bypass authentication or or basically like uh uh change options on a WordPress install and pop a word create an admin account basically or or where just like the plug-in code is so broken that it just allows you to just like get into the admin interface with like completely normal looking requests. WS just like are completely in like blind to these kind of vulnerabilities. The the the security solutions are looking for like hm like does it look sophisticated cross-ite scripting attack like this is like these attacks don't look sophisticated at all. They look like they almost like those attacks look like a normal use of application, but this normal use is actually like a bug in those plugins that allow you to um gain administrative privileges and you can even get access to you can like get like full control over the website without even adding malware on the website. Um so even the malware scanners and things like that didn't you know pick up anything. So, so this is the challenge like this is the that is why I think specifically agencies need to kind of like okay we really need to like look into the WordPress application as a separate place where security needs to be applied and we cannot necessarily just rely on like a hosting company having a firewall somewhere and things like that because they just those firewalls are trying to protect the network or these firewalls are trying to protect the hosting server stack right but what we need where most of the attacks are happening is the application layer which is the WordPress installation itself. So that needs to have a dedicated security. It's fascinating. What I mean what what All right, fine. One last question and and and I'm curious if if maybe you you see this maybe you do. What the heck are people doing with exploiting sites? Like what's the most common thing? Is it like a Bitcoin generator? Like spam links uh spam links to casinos? Like what is it that people are doing on mass against to hack into these sites? They make money like every website online is a resource, right? They can, you know, one of the one of the big things that is being done is like they just they they they take control over the website to use that website as a node in their botnet. And then on the dark web you are selling Titos services for example to you know run targeted again attacks against someone and like take take someone down like you know Cloudflare is continuously like blocking off like you know insane DOS attacks where it's like you know terabytes of data being run against like services to basically you know pull down like massive things. So a lot of those attacks are actually coming from compromised websites like when we're seeing a lot of attacks are coming from you know OVH you know from different hosting companies like we see that the the websites themselves are attacking other websites. So, so that is that is one of the things and then of course uh when it's e-commerce sites they inject like just a you know basically like a key logger uh in in the in the in the front end of the website where all the keystrokes that the that customers are adding on the website is being sent to the hackers. Well, that obviously means also credit card all the credit card billing information that they are adding in when they're doing checkouts, right? Like all this information is being sent to uh to the hackers. So they get credit card uh information and basically money from there SEO stuff right so they don't need to add malware to the website you know then they get busted right they don't want to deface the website because they would get busted the the much more beneficial for the hackers is to gain or u basically compromise the website in such a way that they are kind of like stealthy uh on the background they have full control over the website but they don't necessarily reveal it so they could like you know sometimes add uh you know some links to your blog posts uh you know to get back links uh you know probably you know how many services that are like hey we can sell you back links on you know that number of websites and things like that you know they make a lot of money with that so these are all the things you know redirecting traffic is one of the things like you know everyone knows about the Japanese SEO spam also there's like services to kill other companies SEO by basically intentionally doing black SEO techniques uh to basically kill someone like your competitors SEO, right? Yeah. Yeah. Yeah. All these things is services on the black market that you can basically enroll to and you know uh earn a lot of money. So a lot of site the the the the scary part is that a lot of like what we are seeing is you know half a million websites got hacked last year right okay these are the ones that we detected malware on but there's so many sites that are hacked that nobody knows that they are hacked. So that is what is concerning me the most. Yeah. Yeah, it's it's wild. I think there's better illegal ways to make money. Yeah. Uh, come to the New York Stock Exchange. No. All right. Uh, Oliver from patchack patchack.com. Oliver, thanks. I mean, I was headed into this conversation going, I don't know anything like what am I going to ask? And it's just a ton of information. Uh, thanks so much uh for hanging out, sharing that. Thanks for so much for uh sponsoring the WP Minute. All these resources will be linked up. Again, if you go to the patch footer, there's a ton of re uh resources there. I'll link up this hosting security uh blog post. Uh the WP Minute is uh soon to launch uh a course on how to select uh WordPress hosting companies and we'll definitely use this um as a resource. Oliver, anywhere else you want folks to go to say thanks. You can find me on X or Twitter or whatever it's called nowadays. Uh maybe it's getting a new name soon. Who knows? Uh, anyways, yeah, you can find me there and you can always DM me and reach out. Heard Elon just got a bunch of the AI engineers from Facebook and I was like, didn't Facebook just pay these guys like hundreds of millions of dollars to go there and now he's stealing them, too? Like, what's happening? It's like some guys are making bank like they're just moving from one company to other and seems like the same group of people just going to whoever raised the funds latest. Yeah, they're definitely the ones laughing. Like, who wants it's nuts. Anyway, thanks for hanging out everybody. Thanks for watching the WPinut.com/subscribe. It's the number one way to stay connected. See you in the next episode. Thanks for listening to the WP Minute, part of the Mattreport Media Network. This episode wouldn't be possible without our amazing pillar sponsors, Pressible, Kinsta, GoDaddy, 20I, and Elementor. These brands are supporting WordPress media and helping us invest in your future as a WordPress professional. Our Foundation Plus sponsors like Hostinger, Big Scoots, StellarWP, PersonalizedWP, Wiglot, and Patchstack help us keep the lights on. Thanks to all of our members in the WP Minute Slack channel, which you can join, too. Head on over to the wpmin.com/support to get access. Thanks for listening and don't forget to hit the share button or tell a friend about this podcast. See you in the next one. [Music], How Patchstack Approaches WordPress Security, WP Minute Podcasts, 01k5vmsjs2x6vntgg5wgrsrdwf.