68 SECONDS: HOW ONE FORGOTTEN WEBSITE TOOK DOWN 19 OF MINE

Summary from the TLDR Marketing newsletter

A forgotten WordPress site became the entry point for an attack that infected 19 websites on the same hosting account. The attacker used a stolen password and a file manager plugin to install malware, which spread in 68 seconds and eventually created roughly 400,000 casino spam pages. The malware also hid the pages from site admins, blocked SEO crawlers, and added rogue Google Search Console access. The author details how he contained the breach, traced the source, and rebuilt the sites.