CWP Hack Alert (not an XF exploit) that rewrites your index.php

invalid@example.com (TheLaw), TheLaw
Tue, 11 Nov 2025 02:40:45 +0000
Server configuration and hosting

On some of my sites I have Wordpress installed in subdirectories and they operate independently from Xenforo. I found a strange phenomenon where my site was being taken offline and seeing the index.php replaced with a Wordpress index.php and malicious code stuck in the top. I was wondering whether it was some automated script that was assuming my site was running WP from the root - which I'm not - and just took the site offline. But it apparently does not appear to have been Wordpress that...