In July, the WordPress ecosystem experienced another reminder that even the most widely used platforms can be affected by newly discovered security vulnerabilities. While the technical details of the so-called “wp2shell” vulnerability have been widely discussed elsewhere, we wanted to share something different: how strong observability, proactive maintenance, and disciplined operations enabled us to respond with confidence.
What Was wp2shell?
Imagine discovering that many houses have a window that, under very specific circumstances, can be opened from the outside without the owner’s permission. Those windows themselves aren’t dangerous—until someone discovers the trick and starts trying to find them and exploit that weakness on every house they can find.
The wp2shell vulnerability was similar. It allowed attackers to attempt to gain unauthorized access to vulnerable WordPress installations by exploiting a previously unknown weakness. Once security researchers publicly disclosed the issue, automated scanners and attackers immediately began searching the Internet for websites that had not yet been updated.
For website owners, this created a race against time: update before attackers find you.
Security Is More Than Applying Updates
Applying security updates quickly is essential, but it is only one part of operating a secure hosting platform.
At Simula, we have invested heavily in observability—the ability to continuously understand what is happening across our infrastructure in real time. Rather than simply waiting for customers to report problems, our platform continuously collects operational and security telemetry from the systems we manage.
This allows us to answer important questions immediately:
- Are any hosted websites running a vulnerable version?
- Have attackers started probing our infrastructure?
- Did any exploitation attempts succeed?
- Were any suspicious requests observed before the vulnerability became public?
We actually developed a plugin for WordPress that makes metrics specific to WordPress, such as the current version of the WP instance, available in our observation layer.
Detecting the First Signs
As news of wp2shell emerged, our monitoring systems immediately showed a noticeable increase in reconnaissance and exploitation attempts across the Internet.
Because our observability platform continuously monitors incoming traffic patterns, we were able to see these attack attempts as they began appearing rather than discovering them after the fact.
Furthermore, this visibility allowed us to validate our security posture using real operational data instead of assumptions.
Verifying Every Hosted Website
One of the first questions we asked ourselves was simple:
Are any customer websites still vulnerable?
Using our deployment and asset management systems, we quickly verified that all managed WordPress installations were already running the latest security updates.
This meant there was no emergency patching effort, no uncertainty, and no need to inspect hundreds or thousands of individual websites manually.
Our existing maintenance processes had already done their job.
Looking Back in Time
Observability is valuable not only for seeing what is happening now but also for understanding what happened yesterday.
After confirming that every managed site had been updated, we reviewed historical request data to determine whether anyone had attempted to exploit the vulnerability before it became publicly known.
Our analysis found no evidence of malicious requests matching the characteristics of the wp2shell attack against the WordPress sites we host before the public disclosure.
This retrospective verification provided additional confidence that our customers had not been exposed before patches were available.
Confidence Through Visibility
Incidents like wp2shell demonstrate why modern hosting requires more than simply keeping software up to date.
Security today depends on the ability to continuously observe infrastructure, verify system state, and rapidly answer operational questions with evidence rather than speculation.
For us, the incident was less about reacting to a vulnerability and more about validating that the systems and processes we have built work exactly as intended.
By combining proactive updates with comprehensive observability, we were able to confirm:
- All managed WordPress installations were already running patched versions.
- Attack activity (both malicious and benign scan traffic) was detected as it emerged.
- Historical telemetry showed no prior exploitation attempts against our hosted WordPress websites.
- Customers could continue operating with confidence while the broader Internet responded to the incident.
Security Is a Continuous Process
No hosting provider can promise that new vulnerabilities will never be discovered. What matters is how quickly they can understand their exposure, verify their systems, and respond.
At Simula, we believe observability is one of the most important foundations of modern security. It transforms security incidents from uncertainty into measurable, verifiable events—and gives both our customers and us confidence that the right protections are already in place before the next vulnerability makes the headlines.