3 security measures that close the entry points attackers most often use

On 21 October, we closed the same vulnerability on more than 500 websites

At 21:30 on Wednesday 21 October, four colleagues had updated and restarted more than 500 websites. The vulnerability was in PHP, which powers WordPress among other things, and it could give outsiders access to the server without logging in.

That was not an exception. This is what everyday life looks like now.

For you, this is not about technology. It is about whether customers can submit a quote request, log in to the customer portal, and trust the emails coming from your salespeople. A hacked website or a compromised email account hits sales long before it hits the IT budget.

It happened in just one month

From 27 September to 27 October, the following vulnerabilities appeared, among others:

• PHP: Outsiders could take over the server behind the website without logging in.
• Windows servers that manage the network: Outsiders could run their own code on them.
• A widely used VPN solution for working from home: The vulnerability was exploited before a fix existed.
• Cisco’s email filter: A single email with a specific attachment could give outsiders control of the filter.
• A popular SEO plugin for WordPress: For 11 hours, it was distributed with hidden malicious code.
• A security certificate issuer: Weak keys made it possible to create fake versions of websites.

Here in Denmark, unauthorised parties gained access to information on 8.8 million CPR numbers. According to Ritzau, three accounts at the affected company used the password “123456”.

Not all vulnerabilities are dangerous for you. Many are minor or affect systems you do not use. But AI is now helping both researchers and attackers find vulnerabilities faster, so the time from a vulnerability becoming known to it being exploited is getting shorter.

This is serious. But it can be managed.

How attackers get in

In small and medium-sized businesses, attackers most often get in through three entry points, according to Verizon’s major 2026 data breach report:

1. A known vulnerability that has not been patched: 26%
2. A stolen or weak login: 13%
3. A fake email or message: 9%

So is there a single number for how much the risk drops if you take action? No – not for a complete package. But the three measures below close the two biggest entry points and make the third less dangerous. That is where you get the most security for your money.

1. Update the entire solution and do it quickly

It is not enough to update plugins. The server, PHP and your own code must also be updated. The October vulnerability was in PHP, and no plugin update would have closed it.

Start with a list of all your solutions. Remember your webshop, customer portal, intranet and old campaign pages. You cannot update what you do not know you have and it is often the forgotten campaign page from 2019 that is left exposed.

Ask your web partner three questions:

• How quickly do you patch a critical vulnerability?
• Do you also update the server and PHP, or only plugins?
• How will we be notified when it is done?

If they cannot answer clearly, you have your answer.

2. Enable two-factor authentication

Two-factor authentication means a password is not enough. You also have to approve it on your phone. Microsoft has measured that two-factor authentication stops more than 99% of account takeovers.

Start with email, hosting, DNS and access to the website’s admin. If a salesperson’s email is taken over, the attacker can write to your customers in the salesperson’s name. If your DNS is taken over, the website and email can be pointed somewhere completely different.

Remember to use long passwords and a password manager. And remove logins for former employees on the same day they leave.

3. Take backups and test them

A backup is only worth something if it works. So test that you can actually restore data and how long it takes. That is the difference between the website being down for two hours or two weeks.

Keep at least one copy somewhere other than the server. That way it survives if the server is hit.

Also agree who monitors things and what happens outside office hours. Attackers do not clock off at 4 p.m.

This can wait until the three basics are in place

These measures are good, but they deliver less if the three entry points are still open:

• A filter in front of the website against attacks and overload, e.g. Cloudflare. It buys time, but it does not replace updates.
• Passkeys for administration and finance.
• Logging, so you can see what happened if the worst happens.
• A pen test.
• A one-page incident response plan: Who calls whom if the website is down?

3 things you can do this week

1. Enable two-factor authentication for email, hosting and DNS.
2. Ask your web partner how quickly they patch critical vulnerabilities.
3. Ask for proof that your backup can be restored.

How we reached 500 websites in one evening

The 500 websites were not luck. They are the result of fixed routines that ensure your website is updated before most people have even read the news:

• We typically patch vulnerabilities within 1–2 days.
• Server and PHP updates are automated.
• We scan WordPress sites every night for vulnerabilities and malicious code.
• Two-factor authentication is enforced on all our critical systems.
• We take backups every night, with an extra copy that cannot be deleted in an attack.
• We automatically test that the backups work.
• The operations team reviews alerts every day.
• We have a fixed plan if the worst happens.

Vulnerabilities will happen. What matters is how quickly they are patched.

Frequently asked questions

Get a free security check of your website

We will review the three entry points for you: Are PHP and the server updated? Is two-factor authentication enabled on the most important logins? And is there a backup that can be restored? You will get a short status with what you should do first—regardless of whether you stay with your current web partner.

Write or call me, and we will find a time.

News, you actually wants to read

Join newsletter

Written by

Niclas Johansen

Managing Director – Development, CTO & Partner

[email protected]

42 90 84 28