Who's Patching Your Website? Here's Why That Matters Now

What happened

The Hacker News (opens in a new tab) reported on new research from SOCRadar describing a group called CyberXero that used AI tools, including Anthropic's Claude Code, to automate attacks on WordPress and e-commerce websites. In one scan, the group hit over 4,700 targets and got into 429 WordPress admin panels, all in under a minute.

Researchers said the operation was financially motivated and also tied to a separate, more targeted campaign against infrastructure that reportedly pulled over 628,000 records.

The report found that the attackers got around AI safety refusals by framing requests as an authorized test, then starting a new session whenever the AI pushed back.

Why this matters for your office

If your law firm, medical practice, or accounting office has a website, there's a good chance it runs on WordPress. That's true whether you built it yourself, a marketing company built it for you, or it came bundled with your practice management software years ago.

Here's the question I want every owner and office manager to be able to answer: who is responsible for patching that website?

Not "it's probably fine." Not "I think the web guy handles it." An actual name, and an actual schedule.

This attack didn't involve some brand new, unknown flaw. It used known WordPress vulnerabilities that already had patches available. The problem wasn't the absence of a fix. It was that nobody applied it in time. With AI now doing the scanning and exploiting automatically, the gap between a patch coming out and a site getting hit is shrinking fast.

Your website is your front door. It's often the first thing a new patient, client, or prospect sees, and if it gets hijacked or used to spread malware, that reflects on you, not whoever built it.

What to do this week

1. Find out what your website runs on. Ask whoever built or manages your site if it's WordPress, and if so, which plugins are installed.
2. Name the person responsible for patching it. It might be a vendor, a freelancer, or nobody. If it's nobody, that's the problem to fix first.
3. Ask when the last update happened. WordPress core, themes, and plugins all need regular updates, not just once at launch.
4. Put it in writing. A simple one-page note saying who patches the site and how often takes the guesswork out of it.

I help small offices in Polk County get a clear answer to that first question, and then make sure the plan behind it actually holds up. If you're not sure who's minding your website's security, that's worth a conversation. Take a look at how I handle Cybersecurity & Backup for Small Offices.