WORDPRESS · 9 MINHacked WordPress site: the signs, how to clean it up and how to keep it from coming back
Odd redirects, users nobody created, a Google warning or a host suspending your account. How to confirm your WordPress site is hacked, clean it up in the right order and close the door the attackers used.
BUSINESS · 8 MINPentest vs. security audit: what your company needs, and in what order
An audit finds everything that's open; a pentest proves how far an attacker gets. How they differ, when customers or regulators ask for each, and why closing the basics before you pay for a pentest gets you a better report.
PHP · 8 MINLaravel 11 no longer gets security patches: October's authentication bypass and how to upgrade
A critical flaw in Laravel's TokenGuard lets anyone into an API as another user without knowing their token. Laravel 12 and 13 are patched; Laravel 11 has been out of support since March 2026 and won't be. How to tell if you're affected and how to upgrade.
BUSINESS · 9 MINISO 27001 audit preparation: what the standard asks for and how to get the technical controls ready
ISO/IEC 27001 defines how to manage information security, and certification comes from an independent body. What the standard asks for, which part is technical, and how to walk into the audit with controls working and evidence in order.
SERVERS · 9 MINServer hardening: a practical checklist for Linux servers in production
A practical checklist to harden a Linux server in production: minimal services, default-deny firewall, key-only SSH without root, automatic patches, PHP and web server that don't advertise versions, TLS, logs, backups and least privilege.
BUSINESS · 8 MINSmall business cybersecurity: what to check first, and in what order
A small business doesn't need a security department to close what stops most attacks. Here are eight checks in the order CISA, NIST and CIS recommend, and how to tell whether each one is done.
BUSINESS · 8 MINIT security audit: what it covers, what it delivers and how often to run one
An IT security audit covers cloud, repositories, servers, application code and continuity. What each area includes, how it differs from a pentest and a certification, which deliverables to demand and how often to repeat it.
CLOUD · 8 MINAWS security audit: what it checks, how long it takes and what you should get
What an AWS security audit reviews area by area, what access the auditor needs, what drives the timeline and which deliverables to demand: prioritized findings, fixes with rollback and before-and-after evidence.
PHP · 9 MINHow to upgrade PHP 7.4 / 8.1 to 8.4 without breaking production
PHP 8.1 no longer gets security fixes and PHP 8.2 loses them on December 31, 2026. How to move a legacy system to PHP 8.4 in stages, with testing, a rollback plan and no production outage.
PHP · 7 MINPHP2Shell (CVE-2026-109618): what it is, who it affects and how to tell if your server is exposed
Two critical PHP flaws let anyone run code on your server without logging in, and they are already being exploited. PHP 7.4, 8.0 and 8.1 have no official fixed release. Which versions are at risk, how to check in minutes and what to do today.
Want us to review your company?
Tell us what you run (cloud, servers, PHP, WordPress) and we'll tell you what we'd review first.
Also on WhatsApp at +52 56 6107 7931, or at ventas@wits.mx.