Forensic analysis

Registrar accounts, modified NS and MX records, orphaned CNAMEs: how a domain is hijacked, how to check it with dig, CAA and crt.sh, and what to do if…

Activity logs, remote syslog, MySQL binlog and auditd: how to keep logs that survive an attack and reconstruct an incident on WordPress.

Wordfence Intelligence, WPScan, Patchstack, CVE and CVSS: how to read an advisory, cross-check it against your installed plugins and get only the alerts that matter.

Apache, NGINX, LiteSpeed, and PHP-FPM logs to reconstruct the attack vector, and open Qwen and DeepSeek models run locally to triage anomalous cases.

When a compromised WordPress site becomes a data breach, who must notify the Italian Data Protection Authority within 72 hours, and how forensic evidence guides the assessment.

A vulnerable plugin and no patch: how to tell whether you are exposed, block the endpoint with a WAF, NGINX, or Apache, and look in the logs for…

A fake kworker at 400% CPU: unmask a cryptominer with /proc and ss, find its persistence, stop it in the right order and work out how it got…

Format, paths, time zones and rotation of Apache, NGINX and LiteSpeed logs, plus grep and awk recipes to trace an infected file back to the attack request.

PHP processes deleted from disk but alive in memory, with fake names like kworker: how to find them in /proc, avoid false positives, and save the evidence.