blindfool

This site had an update waiting for it. The update sat there, unapplied, long enough for a stranger to find the door held open.

We walked in. We looked at the server. We looked at the database. We changed the front page. Nothing more.

Here is the part that should sting. Nobody had to guess anything. The version was printed in a public file. The flaw had been documented. One line from a changelog was all it took to know this installation was stale. That line was available to the owner, the hosting provider, the person who installed the theme, and the person who last opened the admin panel. All of them had the same information. None of them acted.

This is what neglect looks like from the outside. It looks exactly like a website that keeps working, so nobody checks. The bills get paid, the certificate renews, the page loads. And underneath, a plugin from an age ago keeps its hand out, ready to accept whatever a stranger brings it.

We did read the database while we were inside. We are not going to pretend otherwise. A copy of the schema and its contents was made, and it stays with us. What we did not do is publish it, sell it, or hand it to anyone else. The only thing we changed on this server is the page you are reading. If this were someone with a different temperament, the story would end differently, and you would be reading it somewhere else.

So take the hint, not the insult. Patch the plugin. Change the passwords and the salts. Look through the upload folder for files nobody remembers placing. Compare the installation against a backup from before this appeared. Stop treating maintenance as a task for a rainy day, because the rain came first.

The update was free. It was sitting right there. The only thing it cost was the desire to install it.