Menu

Support

Support requests and solutions

We were hacked | Wazuh Daily Reporting | AI System Monitoring

,

Our WordPress Website Was Hacked — Here’s How We Caught It Within 24 Hours

Why daily log monitoring matters more than any single security plugin.

Last week, our WordPress website was hacked — servmeit.co.nz was targeted by an automated attack that exploited a known vulnerability in UpdraftPlus, one of the most widely-used WordPress backup plugins in the world. It’s a good reminder of a hard truth in IT security: it’s not a question of if your website will be targeted, it’s a question of how quickly you find out when it happens.

In our case, the answer was: well within 24 hours. Here’s what happened, and why it matters for every business we work with.

What Happened

An automated attacker exploited a known security hole in an outdated version of UpdraftPlus — one of the most widely-used WordPress backup plugins, installed on millions of sites. Through that opening, they planted two hidden files on our site. They disguised them as innocent-looking plugins named “Wp Binder 079” and “Render Craft”. If you’ve found this page because you spotted either of those plugin names on your own site — stop reading, isolate that site right now, then get in touch. Neither is a real plugin.

Both files quietly created a hidden administrator account the attacker could log into later. This completely bypassed the normal login, and WordPress’s admin screens never showed it. One went further: it actively hid its own hidden account from the Users list, so a manual check wouldn’t have caught it either. It also registered a recurring background task to help it stick around and look like legitimate housekeeping.

This is a textbook “backdoor” attack. The goal usually isn’t immediate, obvious damage — attackers plant a foothold quietly, then come back later to do something worse: steal data, deface the site, attack other businesses, or hold it for ransom. We’re deliberately not detailing how either plugin triggered its hidden access. That’s the kind of detail that helps the next attacker, not the next reader.

The Plugin Was “Up To Date” — Almost

Here’s the detail that should make every website owner sit up: we had auto-update switched on for the vulnerable plugin. WordPress doesn’t apply third-party plugin updates the instant they’re released — it checks and applies them on its own schedule. In this case, the fix was already queued but hadn’t run yet when the attacker struck first.

This is the gap that catches people out. Auto-update feels like a solved problem, but a window always exists between a vulnerability becoming known and your site actually receiving the fix. Automated attackers specifically hunt for sites sitting in that window. This isn’t a reason to turn auto-update off — it’s a reason not to treat it as your only line of defence.

Contact us if you've been stung

and would like help cleaning and hardening your system
Email Support

How We Caught It

One of the two planted files contained a coding error. This caused WordPress to fire off its own built-in crash notification, which first caught our attention.

But that’s only half the story — and the less important half. We review security logs on every server we manage, every single day. We use Wazuh, a security monitoring platform, combined with AI-assisted analysis that flags what actually matters out of the thousands of log entries a busy website generates daily.

That daily discipline meant we were already digging into what had changed on the site within hours of the attack, not weeks or months later. We identified both hidden backdoor files and confirmed exactly when attackers planted them. We traced the attack back to the specific vulnerability that let it in. We checked the website’s database and every available log directly, and confirmed the attacker never actually got in — no hidden account ever existed, and no login attempt ever matched their access code. We quarantined the malicious files, patched the vulnerability, and hardened the site against similar attacks, all within the same day.

In short: the attacker got a foot in the door, but we closed it before they could walk through.

Why This Matters For Your Business

Most businesses only find out their WordPress website was hacked one of two ways: a customer tells them something looks wrong, or Google flags the site as unsafe. By then, the attacker has often had the run of the place for weeks.

The difference comes down to one thing: is anyone actually watching?

Keeping plugins updated is essential, and auto-update should be switched on everywhere it can be — but as this incident shows, even that isn’t a guarantee. Updates run on a schedule, vulnerabilities get exploited the moment they’re public, and there’s always a window between the two where a plugin can be technically “up to date” on paper and still vulnerable in practice. A security plugin on its own isn’t enough either — plugins get out of date, and vulnerabilities get discovered faster than any single tool can keep up with. What actually catches an attack in that window — the one neither patching nor a security plugin alone can close — is continuous monitoring and someone reviewing what the logs are telling you, every day, not just when something visibly breaks.

That’s exactly what’s included as standard for every website and server we manage at ServMe IT:

  • Daily log review across every managed server, using Wazuh security monitoring
  • AI-assisted analysis to surface genuine threats out of the noise, so nothing slips through because a human got busy
  • Rapid incident response — when something is found, we act the same day, not the same week
  • File integrity monitoring to catch unauthorized changes to your website’s code the moment they happen

If this had been a client site instead of our own, the process would have been identical — the same daily review, the same rapid response, the same result: caught and closed before any damage was done.

Check out our other Blogs

Show me more

Is Your Website Actually Being Watched?

  • Has your WordPress website been hacked, or are you worried it could be? If you’d like us to take a look at your current setup — no obligation — get in touch and we’ll let you know exactly where you stand.

  • If your current hosting or web support doesn’t involve someone actively reviewing security logs every day, the honest answer is: you probably won’t know about an attack like this one until it’s too late.

  • We provide weekly reports summarising what we have done for you during the week.

Talk to us

about securing your website
Email Support

Every morning at ServMe IT | Wazuh Reporting | System Monitoring

,

Email Hosting | Microsoft 365 Email

ServMe IT has had a question from a customer using cPanel for his email accounts. He wants to migrate to Microsoft so he can use Teams and Calendar, but he wants to keep some of his emails in cPanel.

Problem

A customer has used several business emails just for logging in to various websites. The emails do not send and receive email, but may be required for password resets. As the address isn’t used as a “live” mailbox, the customer doesn’t want to purchase licenses from Microsoft to keep the address. Is there a way of doing this for free?

Answer

The simple answer is yes.

The bigger question is, should we try configure two hosting providers with the one business domain, or can we do this with Microsoft alone?

The answer is, we can do it either way. It is much higher risk using two providers as there is a complex configuration we would need to go through to ensure mail is routed to the correct provider, depending on the email address used.

This is achieved using:

  • Microsoft 365 as the primary mail server (MX records point to Microsoft)
  • Mail flow connectors in Exchange Online
  • Shared domain configuration
  • Forwarding / routing rules between Microsoft and cPanel

Microsoft calls this a “shared email domain” or hybrid mail routing.

This works, but:

  • More complex to set up
  • More difficult to troubleshoot
  • Can cause mail loops if configured incorrectly

I generally only recommend this when a customer is migrating gradually.

I would like to move my emails

to Microsoft 365 Business
Email Support

Preferred Solution

Move Everything to Microsoft 365 (Recommended)

This is usually the best solution if the customer wants:

  • Microsoft Teams
  • Shared calendars
  • Outlook integration
  • OneDrive
  • SharePoint
  • Exchange Online email

In this setup:

  • Email is hosted in Microsoft 365.
  • The domain’s MX records point to Microsoft.
  • cPanel email accounts are migrated and then retired.

This gives the cleanest experience and avoids mail routing issues.

The “inactive” Mailbox Solution

How do we then handle our “unused” email addresses?

The Shared Mailbox

A common trick is:

  1. Create a licensed user mailbox (e.g. info@company.co.nz).
  2. Convert it to a Shared Mailbox.
  3. Remove the licence.

The mailbox continues to work as a Shared Mailbox provided:

  • It stays under 50 GB.
  • No Exchange Online Archive is required.
  • Nobody logs in directly to the mailbox.

Users with their own licensed accounts can then access the shared mailbox.

If they want:

and each person has their own login, Outlook, Teams and Calendar, then each user needs a licence such as:

  • Microsoft 365 Business Basic, or
  • Microsoft 365 Business Standard

Example

A common setup is:

Mailbox Licence
grant@servmeit.co.nz Business Standard
accounts@servmeit.co.nz Shared Mailbox
support@servmeit.co.nz Shared Mailbox
sales@servmeit.co.nz Shared Mailbox

 

That gives you one paid licence and multiple departmental addresses.

Check it out our other Blogs

Show me more

Get Started with your own web hosting

  • Ready to register a domain or set up hosting for your business?

Visit billing.servmeit.co.nz to get started, or contact us if you’d like to discuss your requirements.

System Monitoring | AI Reporting | Daily Routine

,

Customer System Monitoring

ServMe IT takes pride in the fact our System Monitoring tools are amongst the best in the world. We are also actively using AI to manage our system monitoring, which means nothing falls through the cracks. Each morning, we have a routine which ensures any issues found in the last 24 hours are actioned. Here’s a blog article showing you just what this looks like.

How We Use Wazuh and AI to Turn 15,000 Security Events Into a Two-Minute Read

Every morning, before most of our clients have opened their laptops, our infrastructure has already logged somewhere upwards of ten thousand security events. SSH scanners probing for weak passwords. Bots poking at old backup files. Routine Windows housekeeping. The occasional real finding buried somewhere in the middle of it all.

The hard part of cybersecurity monitoring was never collecting that data. Tools have been doing that well for years. The hard part is turning it into something a human being can actually read, understand, and act on before their coffee goes cold. That’s the problem we set out to solve with our own infrastructure first, before rolling the same approach out to client environments.

The tool

Wazuh is an open-source security monitoring platform — part SIEM (Security Information and Event Management), part host-based intrusion detection, part vulnerability scanner. It sits as an agent on each server or workstation we manage, watching for things like failed logins, file integrity changes, new vulnerabilities in installed software, and suspicious patterns in web server and system logs. It’s genuinely good at its job.

It’s also, out of the box, extremely noisy. A single day of normal, healthy operation across a handful of servers generates thousands of log lines — most of them routine, a few of them worth a second look, and a rare few that need action today. Reading that raw feed every morning isn’t a sustainable way to run a security practice, for us or for anyone.

Learn more about how

ServMe IT can monitor all your systems
Email Support

The problem: signal buried in noise

Here’s a taste of what a single 24-hour window can look like, based on a recent report from our own internal infrastructure (server names, IP addresses, and account names below have been changed to generic examples — this isn’t our real network):

  • Roughly 4,000 combined SSH login attempts against one server, mostly automated bots trying the root account or guessing usernames
  • Over 5,000 hits from web recon bots probing for exposed .env files, old PHP info pages, and backup files
  • Nearly 800 routine Windows registry and file-integrity events on a single, monitored workstation
  • Two newly disclosed CVEs picked up by the vulnerability scanner
  • One changed crontab entry, one denied sudo attempt, and one flagged “bot-like” traffic pattern that turned out to be a monitoring dashboard refreshing itself

None of that is unusual for an internet-facing server in 2026 — background scanning is just the ambient noise of being connected to the internet. But somewhere in a list that long, there might be one line that actually matters. Finding it manually, every single day, doesn’t scale.

The fix: AI as a triage layer, not a replacement for judgment

This is where we layer AI on top of Wazuh, rather than relying on either tool alone. Each morning, an automated process pulls the last 24 hours of Wazuh alerts and runs them through an AI summarization step before a human ever looks at it. The AI’s job isn’t to make security decisions — it’s to do the sorting that would otherwise eat an hour, or more, of an analyst’s morning: grouping related events, recognizing routine patterns (a certificate renewal cron job, a scheduled package update, a dashboard polling its own server), and surfacing anything that breaks that pattern.

The output lands in three tiers:

Urgent — anything that would justify getting a phone call, like a successful unauthorized login, a critical file integrity violation, or a remotely exploitable vulnerability on something internet-facing. On a good day, and most days, this section is empty. That’s the point.

Action — findings worth a human decision, but not a fire drill. Not “nothing happened,” but “someone should look at this and confirm it’s expected.”

Information — the routine background noise, kept visible for anyone who wants it, but explicitly separated so it doesn’t drown out anything that matters.

What an “Action” item actually looks like

To make this concrete, here’s an anonymized excerpt from one of our own daily reports, with real hostnames, IP addresses, and account names swapped for generic examples:

Time Host Finding Detail
07:10 vms.servmeit.co.nz New CVE detected (High severity) Vulnerability found in an installed package; requires a local trigger to exploit, not remotely exploitable — added to the patch watch-list rather than treated as urgent
14:11 vms.servmeit.co.nz Repeated SSH login attempts using root Blocked automatically by server configuration; no successful login
04:35 vms.servmeit.co.nz Root’s scheduled-task list was modified Consistent with a routine certificate renewal job — flagged so a human can confirm it was expected
01:43 vms.servmeit.co.nz Denied sudo attempt by a non-admin account Access correctly denied by permissions; worth confirming the account itself is still expected to exist
04:48 vms.servmeit.co.nz Scanning for exposed backup and config files 106 probe attempts from roughly a dozen source addresses (e.g. 203.0.113.14, 198.51.100.77); all returned “access denied” — nothing exposed


And, just as usefully, here’s what the AI correctly filtered out of the urgent conversation: a “high volume of automated-looking requests” alert that traced back to an internal monitoring dashboard on our own network refreshing itself every few seconds — a textbook false positive that a purely rules-based alert would have flagged as suspicious traffic. Recognizing “this is us, doing something normal” is exactly the kind of triage that saves a security team from chasing its own tail.

Check it out our other Blogs

Show me more

Why this matters for a small or medium business

Most SMBs don’t have — and shouldn’t need — a dedicated security operations team staring at dashboards all day. But “we don’t have a SOC” shouldn’t mean “we don’t know what’s happening on our network.” A daily report that’s genuinely readable in two minutes, that tells you plainly whether anything needs your attention today, and that doesn’t cry wolf over routine background scanning, is the middle ground most businesses actually need.

We built this for our own infrastructure first because we weren’t willing to hand a client something we hadn’t trusted with our own systems. Now that the process has proven itself day after day — catching real findings, correctly ignoring the noise, and staying honest about what it doesn’t know — we’re extending the same Wazuh-plus-AI daily reporting to client environments as part of our managed IT and hosting services.

Every daily report we generate is filed away permanently in our internal knowledge base, so there’s always a full, searchable history to look back on if something needs investigating down the track. Customers don’t need to read a report like this every single day, though — instead, we roll the week’s findings up into a single plain-English summary that’s shared at the end of each week (if you wish), so you get the full picture without the noise.

If you’d like to know what this would look like for your own business — what’s currently scanning your servers, what’s routine, and what actually deserves a phone call — get in touch with ServMe IT.

Find out more

about your systems and how we can secure them
Email Support

Interestedin hosting your own website?

  • Ready to register a domain or set up website and email hosting for your business?

Visit billing.servmeit.co.nz to get started, or contact us if you’d like to discuss your requirements.

Microsoft 365 Email | Migrating Emails | Rehosting Email

,

Email Hosting | Microsoft 365 Email

ServMe IT has had a question from a customer using cPanel for his email accounts. He wants to migrate to Microsoft so he can use Teams and Calendar, but he wants to keep some of his emails in cPanel.

Problem

A customer has used several business emails just for logging in to various websites. The emails do not send and receive email, but may be required for password resets. As the address isn’t used as a “live” mailbox, the customer doesn’t want to purchase licenses from Microsoft to keep the address. Is there a way of doing this for free?

Answer

The simple answer is yes.

The bigger question is, should we try configure two hosting providers with the one business domain, or can we do this with Microsoft alone?

The answer is, we can do it either way. It is much higher risk using two providers as there is a complex configuration we would need to go through to ensure mail is routed to the correct provider, depending on the email address used.

This is achieved using:

  • Microsoft 365 as the primary mail server (MX records point to Microsoft)
  • Mail flow connectors in Exchange Online
  • Shared domain configuration
  • Forwarding / routing rules between Microsoft and cPanel

Microsoft calls this a “shared email domain” or hybrid mail routing.

This works, but:

  • More complex to set up
  • More difficult to troubleshoot
  • Can cause mail loops if configured incorrectly

I generally only recommend this when a customer is migrating gradually.

I would like to move my emails

to Microsoft 365 Business
Email Support

Preferred Solution

Move Everything to Microsoft 365 (Recommended)

This is usually the best solution if the customer wants:

  • Microsoft Teams
  • Shared calendars
  • Outlook integration
  • OneDrive
  • SharePoint
  • Exchange Online email

In this setup:

  • Email is hosted in Microsoft 365.
  • The domain’s MX records point to Microsoft.
  • cPanel email accounts are migrated and then retired.

This gives the cleanest experience and avoids mail routing issues.

The “inactive” Mailbox Solution

How do we then handle our “unused” email addresses?

The Shared Mailbox

A common trick is:

  1. Create a licensed user mailbox (e.g. info@company.co.nz).
  2. Convert it to a Shared Mailbox.
  3. Remove the licence.

The mailbox continues to work as a Shared Mailbox provided:

  • It stays under 50 GB.
  • No Exchange Online Archive is required.
  • Nobody logs in directly to the mailbox.

Users with their own licensed accounts can then access the shared mailbox.

If they want:

and each person has their own login, Outlook, Teams and Calendar, then each user needs a licence such as:

  • Microsoft 365 Business Basic, or
  • Microsoft 365 Business Standard

Example

A common setup is:

Mailbox Licence
grant@servmeit.co.nz Business Standard
accounts@servmeit.co.nz Shared Mailbox
support@servmeit.co.nz Shared Mailbox
sales@servmeit.co.nz Shared Mailbox

 

That gives you one paid licence and multiple departmental addresses.

Check it out our other Blogs

Show me more

Get Started with your own web hosting

  • Ready to register a domain or set up hosting for your business?

Visit billing.servmeit.co.nz to get started, or contact us if you’d like to discuss your requirements.

Powered by CookieAdmin
×