AI Agents Hacking Websites Is Scary Good and It’s Happening Now

A popular WordPress backup service has been breached, and attackers are using stolen management keys to install backdoors. But here’s what makes this particularly serious: even a fully updated website could accept those commands.

Today we’re also looking at AI agents breaking into business websites, an Australian cloud service disruption, exposed API credentials, and a payment flaw that could let customers receive orders without paying. Hi, I’m Dustin Gray. I’ve been building production software for 25 years, and I look at the security stories that matter today.

Let’s start with WordPress. Attackers have compromised the management service connected to UpdraftPlus. That’s a popular WordPress backup plugin, and the service is called UpdraftCentral.

It allows website owners to manage multiple WordPress sites remotely. But attackers reportedly gained access to its customer database, and that database contains keys used to control connected websites.

And here’s where it gets particularly serious. The attackers didn’t need to break into each website individually. They used management keys those websites already trusted.

Security researchers have confirmed that malicious plugins were installed on real websites, and those plugins could provide attackers with persistent access. Now, not every UpdraftPlus installation is affected. The attack requires an active connection to the cloud-hosted UpdraftCentral service.

So today’s action: ask your team whether your website is connected to UpdraftCentral, and if it is, revoke the existing connection keys immediately. Check for unfamiliar plugins and administrator accounts, and investigate whether malicious code has already been installed. Follow the vendor’s recovery instructions before reconnecting, because updating a plugin won’t necessarily remove an attacker who’s already inside.

Next up, a warning about how attackers are using AI agents. Researchers have documented an attacker using AI to compromise more than 100 business websites, and some Australian websites were among the targets.

But here’s what makes this interesting. The attacker didn’t manually investigate every website. They gave AI agents instructions to find weaknesses, and the agents continued working for hours.

In one case, the main website resisted the attack, so the agents searched for another way in. They discovered a separate management interface and used weaknesses in that system instead. Now, the research confirms successful intrusions into business websites, but Australian targeting doesn’t establish that an Australian business was successfully compromised.

So today, identify every internet-facing system connected to your website. That includes staging environments, admin panels and forgotten applications. Restrict unnecessary public access and make sure suspicious activity is logged and monitored, because protecting your homepage means very little if the back door to your infrastructure is left wide open.

Next up, a cyber security incident affecting Bullhorn. That’s a cloud platform used by recruitment businesses. The company recently disabled services while investigating the incident, and yesterday it reported that Australian services were coming back online.

But here’s the important distinction. Getting a website running again doesn’t necessarily mean the business has fully recovered. Some customers were required to reset their passwords, and Bullhorn warned about scammers impersonating its support staff.

Now, think about what happens when a business relies on one cloud platform. Customer records, recruitment workflows and integrations may all depend on that service. If it goes offline, those business processes can stop.

The company has confirmed a cyber security incident, but the available evidence doesn’t establish customer data theft yet. Today’s action: if your organisation uses Bullhorn, check its official service status and complete any required password resets.

Then test your integrations and automated workflows. Don’t assume everything is working simply because users can log in again, because restoring availability is only one part of incident recovery.

Next up, another warning for organisations using AI development tools. OpenCode has disclosed a breach affecting some users of its hosted console service. That’s the service used to connect AI coding workflows to external model providers.

But here’s where the financial risk becomes real. Some affected users reported unexpected charges on their AI provider accounts. The attackers could use exposed provider keys to consume paid AI services.

Now, this doesn’t mean every OpenCode installation was compromised. The incident affected a subset of hosted console users, but it does demonstrate a growing problem with AI infrastructure. An API key isn’t just a technical credential; it can also provide access to sensitive services and significant spending authority.

If your organisation used the affected OpenCode console service, revoke exposed provider keys, generate new credentials and review recent API usage. Check for unexpected charges and establish spending limits wherever your provider supports them. An attacker doesn’t always need to steal your data to cost your business money; sometimes they just need to access your account.

And finally, a newly disclosed vulnerability affecting a WooCommerce payment plugin. The plugin is called iPOSpays Payment Gateway, and it’s used to connect WordPress online stores to payment processing.

But researchers identified a problem with how payment completion was verified. Under affected conditions, an attacker could make an unpaid order appear paid, and they wouldn’t even need a WordPress account.

Now, this doesn’t affect every WooCommerce website. Only stores using the vulnerable iPOSpays gateway are exposed. But consider the business consequence: a customer places an order, the website records it as paid, and the business potentially ships the goods without ever receiving the money.

So if your store uses iPOSpays, confirm you’re running version 1.4.7 or later. Then compare recent completed orders against your payment provider’s settlement records. Investigate any orders marked paid without a matching transaction, because a payment status on your website isn’t proof that the money actually changed hands.

Now, there’s a common lesson across today’s five stories, and it comes down to something we rely on every day: trust. A backup service trusts a management key, and an AI agent trusts the systems it’s allowed to access. A business trusts a cloud provider, an AI service trusts an API credential, and an online store trusts a payment confirmation.

But here’s the problem: a trusted request isn’t necessarily a legitimate request. That’s why security needs more than passwords and software updates. It needs independent checks, restricted permissions and monitoring, and it needs a plan for when those controls fail.

Because “it works” isn’t the same as “it’s secure and production ready”. So here’s what you should look at today: which trusted integration could give an attacker access to your business without anyone noticing?