Markdown Content - My Personal Mythos Moment

---
# My Personal Mythos Moment

**URL:** https://crunchtools.com/my-personal-mythos-moment/
Date: 2026-07-23
Author: fatherlinux
Post Type: post
Summary: How I got hacked twice in one month by two different attackers — and fixed it with 3-5 AI prompts while on work calls. My personal Mythos moment.Continue Reading "My Personal Mythos Moment" →
Categories: Articles
Tags: AI/ML, Best Practices, Security, Systems Administration
Featured Image: https://crunchtools.com/wp-content/uploads/2026/07/mythos-moment-thumbnail.png
---

On Tuesday, July 21st, 2026, I discovered I got hacked. Not once, but twice. By two different attackers, with the first breach actively enabling the second. It was my personal Mythos moment. It started June 25th, three weeks after CVE-2026-10795 was disclosed for the UpdraftPlus backup plugin, an authentication bypass that let attackers forge admin commands against sites connected to UpdraftCentral, which both of mine were. The first attacker got in quietly, planted backdoor plugins, and disabled auto-updates. Then on July 17th, wp2shell dropped: two WordPress core CVEs chained together. A SQL injection and a REST API route confusion bug, which combined, created an unauthenticated remote code execution bug on any unpatched WordPress site. My sites were unpatched because the first attacker had made sure of it. The second attacker hit on July 21st, and their exploit conflicted with the previous attacker's, leaving the site broken.

How do I know this?

Because AI helped me figure it out... while I was multi-tasking on other calls for work.

I was on back-to-back calls that afternoon when I got an alert that crunchtools.com was down. Without even investing the site myself, I opened a conversation with Josui, my Claude Code agent setup, and asked him to take a look. What he found wasn't a misconfiguration or a crashed container. The site had been hacked, and not just recently. I immediately commanded Josui to walk through my other wordpress site. He immediately identified the backdoor plugins, found the use of the mu-plugin directory, spotted the hidden admin users, and cleaned everything. Then we went further: hardened both sites, updated Cloudflare rules, blocked REST API user enumeration, removed version disclosures, created firewall page rules. The whole remediation and hardening operation was maybe 3-5 substantial prompts on my end, and a lot of waiting for tool calls to run.

To appreciate why this felt like a shift, you have to understand where I'm coming from. I've done this before, the old way. Years ago, one of my sites got compromised, and I spent what I remember as a couple of frustrating weekends trying to clean it up myself, eventually paying a security consultant to finish the job. That was a minor incident by comparison. The attack chain I described above, the UpdraftPlus entry, the backdoor plugins, the mu-plugin persistence, the hidden admin users, the wp2shell refresh, would have taken me weeks to fully understand, let alone remediate. I would have had to trace through the logs manually, understand what each malicious artifact was doing, research the CVEs, figure out the right hardening steps, and probably still miss things. And then do it all over again for the second site.

There's a common assumption that offense is inherently easier than defense in security, but I'm not sure that's historically accurate. Few nations have ever maintained truly expeditionary military capability; the US, France, China, a handful of others. Most armies throughout history have been better at defending their own territory than projecting force elsewhere. For most of my career as a sysadmin, computer security felt similar: you could play solid defense with good discipline and attention to detail, without needing to be a genius. Sure, the attacker had to find one hole; I had to close them all. That's the old saying. But at least I could force the attacker had to spend a ton of time, energy and IQ points. Remote root exploits have historically been very difficult to find.

AI-assisted exploit chaining changed everything (say that three times quickly). The balance tipped. The chaining attacks I described above, the kind of multi-stage, patient, automated compromise that hit my sites, represent a level of offensive sophistication that used to require a lot of very smart people working together. This has clearly created a serious problem for defenders like me. I always relied on careful discipline, based on solid risk models (confidentiality, availability, integrity, non-repudiation).

What I experienced on July 21st felt like it might be tipping back, at least a little. Claude helped me kick the attackers out while the site was live, patch the vulnerabilities so they couldn't get back in the same way, and then harden everything so that, barring another chaining attack nobody's found yet, they hopefully can't come back. It's genuinely inconvenient to fight break-ins in real time, and I'm not going to pretend this is fully solved. But I think the longer-term trajectory is that AI is going to help the good guys beef up the defense of existing codebases in ways that start tilting things back in favor of defenders. Fingers crossed.

---

## Categories

- Articles

---

## Navigation

- [Home](https://crunchtools.com/)
- [Articles](https://crunchtools.com/category/articles/)
- [Events](https://crunchtools.com/category/events/)
- [News](https://crunchtools.com/category/news/)
- [Presentations](https://crunchtools.com/category/presentations/)
- [Software](https://crunchtools.com/software/)
- [Beaver Backup](https://crunchtools.com/software/beaver-backup/)
- [Check BGP Neighbors](https://crunchtools.com/software/check-bgp-neighbors-nagios/)
- [Chev](https://crunchtools.com/software/chev-check-vulnerabilities-script/)
- [Graph BGP Neighbors](https://crunchtools.com/software/grpah-bgp-neighbors/)
- [Graph MySQL Stats](https://crunchtools.com/software/graph-mysql-stats/)
- [Graph Sockets Pipes Files](https://crunchtools.com/software/graph-sockets-pipes-files/)
- [MCP Servers](https://crunchtools.com/software/mcp-servers/)
- [Petit](https://crunchtools.com/software/petit/)
- [Racecar](https://crunchtools.com/software/racecar/)
- [Shiva](https://crunchtools.com/software/shiva/)
- [About](https://crunchtools.com/about/)

## Tags

- AI/ML
- Best Practices
- Security
- Systems Administration