Date: Fri, May 29, 2026 at 10:04 AM
Subject: Fwd: Olympians Reject “Pointless” Offer To Meet Swim
|
|
Friday, May 29, 2026
British Olympians Reject “Pointless” Offer To Meet Swim England Chair As Resignation Calls Grow Louder
Date: Fri, May 29, 2026 at 10:04 AM
Subject: Fwd: Olympians Reject “Pointless” Offer To Meet Swim
We Found a Backdoor: Lessons From a WordPress Intrusion
Website security is one of those topics that most people ignore until the moment they can't.
This week, I found myself deep inside a WordPress security incident that unfolded across several websites hosted on the same account. What began as a routine investigation of strange activity eventually revealed unauthorized administrator accounts, hidden files, malicious code, and a site that appeared determined to resurrect itself after deletion.
The experience reinforced several lessons that every website owner should know.
The First Signs
The initial clues were subtle.
Wordfence security scans began reporting unusual activity. Login attempts were pouring in from around the world. Some sites became difficult to access. Administrator accounts appeared that nobody remembered creating.
At first, it was tempting to believe this was merely a configuration problem. After all, security plugins can sometimes lock out legitimate users. Wordfence itself was causing some confusion as settings were adjusted and security measures were tightened.
But then came the discovery that changed the story.
Unauthorized administrator accounts appeared.
Not one.
More than one.
Deleting them did not immediately restore confidence because the obvious question remained:
How did they get there?
Following the Trail
The investigation quickly moved beyond WordPress settings.
Files that did not belong inside WordPress core directories began appearing in security scans.
Examples included:
- outbound.php
- wp-olite.php
- mjc0.php
- dwn2.php
- perl.haxor
- py.haxor
These files were located inside directories where WordPress core files normally reside.
That was a major warning sign.
WordPress core directories should contain WordPress files. They should not contain mysterious PHP scripts with odd names.
Wordfence identified twenty-three such files.
They were deleted.
The Site That Would Not Die
One website in particular, waterpolo.cloh.org, became the center of the investigation.
The infected site was renamed so it could no longer function normally.
The directory was moved out of service.
The malicious files were removed.
And yet parts of the directory structure appeared again.
A hidden .htaccess file surfaced inside a deep WordPress directory. Its purpose was clear: permit PHP execution in places where it normally should not occur.
That was a significant discovery because many malware families attempt to hide inside legitimate-looking folders and then use .htaccess files to bypass normal restrictions.
The site had effectively become untrustworthy.
At that point, the goal shifted from repair to containment.
Containment Steps
Several actions were taken immediately.
Remove Unauthorized Administrators
Every WordPress site was reviewed.
Unknown administrator accounts were deleted.
Known administrator accounts were reviewed.
Passwords were changed.
Enable Two-Factor Authentication
Administrators gained two-factor authentication.
A stolen password becomes far less useful when a second factor is required.
Rotate WordPress SALT Keys
WordPress security keys were replaced.
This forced existing login sessions to become invalid.
Anyone who had obtained a session cookie suddenly found that cookie worthless.
Change Database Passwords
Database credentials were rotated.
Fresh credentials were stored in Bitwarden.
Harden .htaccess
Additional protections were added.
Directory browsing was disabled.
XML-RPC access was blocked.
Direct comment posting was blocked.
The resulting additions looked like this:
These protections now form part of my standard WordPress hardening process.
Review Unknown Files
Security scans identified files that did not belong.
Rather than ignoring warnings, each item was investigated.
Unknown files inside WordPress core locations should never be dismissed casually.
What the Attackers Were Doing
The Wordfence live traffic screen provided a fascinating view into the reality of operating a public website.
Login attempts arrived from:
- Vietnam
- Turkey
- Lithuania
- Spain
- Brazil
- The Netherlands
- The United States
The attackers probed:
- wp-login.php
- xmlrpc.php
- wp-plain.php
They searched for known vulnerable plugins.
They tested common backdoor locations.
This activity was not targeted specifically at me.
It was automated.
Every exposed WordPress site on the internet receives similar attention.
The difference is whether the defenses hold.
An Important Realization
One of the most useful lessons from this experience was recognizing the difference between noise and evidence.
The internet is noisy.
Bots hammer login pages constantly.
Wordfence blocks many attacks every day.
Most of that activity is routine.
What changed this case was the appearance of unauthorized administrator accounts and malicious files in WordPress core directories.
Those are not normal events.
Those are evidence.
The Human Side
The process was frustrating.
Files appeared, disappeared, and reappeared.
FTP and hosting control panel views sometimes disagreed.
Security tools occasionally became obstacles themselves.
At several points it felt impossible to determine whether the problem was malware, caching, configuration mistakes, or all three.
That uncertainty may be the hardest part of dealing with a website intrusion.
You rarely receive a flashing sign that says:
"Here is the exact problem."
Instead, you collect clues.
You test theories.
You eliminate possibilities.
Eventually a picture emerges.
The Final Lesson
The biggest takeaway from this experience is simple.
Security is not a product.
It is a process.
No plugin can completely protect a website whose passwords are weak.
No password can completely protect a site running vulnerable software.
No scan can protect a site that nobody reviews.
Security comes from layers:
- Strong passwords
- Password managers
- Two-factor authentication
- Software updates
- Security monitoring
- Regular reviews of administrator accounts
- Backups
- Healthy skepticism
Most website owners will never face a major compromise.
But if they do, preparation matters.
The best time to improve security is before you need it.
The second-best time is tonight.
Thursday, May 28, 2026
Old Paper Wars
Paper Wars on Grant Street
There was a season in Pittsburgh politics when democracy felt like paperwork.
Not speeches.
Not television ads.
Not viral videos.
Paper.
Petitions.
Signatures.
Affidavits.
Notaries.
Court filings.
Election codes.
Deadlines.
Technicalities.
Challenges.
Objections.
The entire machinery of local democracy often came down to who filed what, when, with which signatures, under which party designation, before which clerk, in which room of the City-County Building.
And for a brief moment in the mid-2000s, I found myself wandering directly into that machinery.
Not as a lawyer.
Not as a party insider.
Not as a wealthy donor.
But as a citizen candidate armed with petitions, election law printouts, handwritten notes, and an increasing fascination with how fragile the system actually was.
Looking back now, these court filings read almost like artifacts from another civilization.
A slower political era.
A more procedural era.
A more local era.
An era before social media swallowed politics whole.
At the center of these filings were challenges to nomination petitions involving candidates for Pittsburgh City Council District 3, including Bruce Kraus and Bruce Krane.
The legal arguments themselves now feel wonderfully specific and almost antique.
Could candidates gather signatures while aligned with a major political party and then pivot into an “independent” or political-body candidacy?
Could someone simultaneously navigate both tracks of the election system?
Did the timing of party changes matter?
Did the signatures remain valid?
Did the paperwork comply precisely with election law?
Was the Bureau of Elections properly enforcing standards?
These were not abstract philosophical questions.
These were ballot-access knife fights.
The filings argued that election law existed for reasons larger than mere technical compliance. They cited court decisions warning against “splintered parties,” “voter confusion,” “frivolous candidacies,” and manipulations of the political process.
At the time, Pittsburgh politics still carried strong traces of old machine culture.
Party endorsements mattered enormously.
Committee structures mattered.
Relationships mattered.
Who got frozen out mattered.
Who had institutional support mattered.
And perhaps most importantly, who understood the procedural rulebook mattered.
Outsiders rarely won.
But outsiders could disrupt.
That was part of the energy of the moment.
The filings themselves were intensely pro se. Citizen-driven. Improvised. Long before ChatGPT, legal templates, or modern digital organizing tools, ordinary people pieced together court challenges using photocopies, law library research, election code citations, conversations, rumor, persistence, and stubbornness.
There is something beautifully chaotic about that now.
One section argued that candidates could not legally ride both horses at once: pursuing Democratic primary legitimacy while simultaneously maneuvering toward independent ballot status.
Another section drilled into the signatures themselves.
Who signed?
When?
Under what party understanding?
Which names were registered voters?
Which handwriting appeared suspiciously similar?
Which notary relationships raised concerns?
One filing bluntly claimed that an entire page appeared to be written “with the same pen and hand.”
Today, some readers may laugh at the hyper-focus on signatures and filing mechanics.
But ballot access is power.
Election procedure is power.
Administrative interpretation is power.
Democracy is not merely ideology. It is process.
And process determines who even reaches the ballot.
That reality remains true today, even if modern politics now performs itself through podcasts, cable news clips, fundraising emails, influencer culture, and algorithmic outrage.
Behind every election still sits a quieter world of filings, deadlines, certifications, technical disputes, and procedural leverage.
The old filings also reveal something deeper about Pittsburgh political culture during that period.
There was distrust everywhere.
Distrust of insiders.
Distrust of party structures.
Distrust of endorsements.
Distrust of city government.
Distrust of overlapping relationships.
Distrust of political maneuvering.
The ethics complaints from that same era carried similar themes.
Who belongs to what organization?
Who watches whom?
Who owes favors?
Who can actually act independently?
Who gets protected?
Who gets excluded?
The election petitions were another front in the same larger civic argument.
Maybe all of it stemmed from a city trying to reinvent itself while still carrying the DNA of old industrial political culture.
Pittsburgh was shrinking in population but exploding with institutional complexity.
Nonprofits were rising.
Foundations were rising.
Universities were rising.
Development authorities were rising.
Political consultants were rising.
Public-private partnerships were rising.
Yet ordinary citizens often still felt locked outside the machinery.
So some citizens fought through procedure instead.
Through hearings.
Through filings.
Through technical challenges.
Through the courts.
Was that democratic accountability?
Or procedural trench warfare?
Maybe both.
One thing becomes very clear rereading these petitions now:
Local democracy used to require physical endurance.
People drove downtown.
Waited in offices.
Hand-delivered paperwork.
Made photocopies.
Read actual election law books.
Tracked filing deadlines manually.
Visited courtrooms.
Talked directly to election officials.
There was friction everywhere.
And strangely enough, that friction may have produced more civic literacy than today’s instant-comment politics.
Modern political participation is often emotional but shallow.
Back then, participation could become obsessive and procedural.
You learned how systems actually worked.
Or failed to work.
The petitions themselves repeatedly invoke “the integrity and stability of the political system.”
That phrase now feels almost haunting.
Because twenty years later, Americans trust institutions even less.
Trust in elections is weaker.
Trust in government is weaker.
Trust in media is weaker.
Trust in expertise is weaker.
And yet most citizens remain far less connected to the procedural mechanics underneath public systems.
Few people know how ballot access works.
Few people understand nomination petitions.
Few people know how local election boards function.
Few people have ever filed a formal challenge.
Few people know where power actually lives.
That ignorance creates openings for insiders.
Always.
Perhaps that is one lesson hidden inside these dusty filings.
Democracy belongs not only to charismatic candidates or wealthy donors or political parties.
It also belongs to citizens willing to read the fine print.
Citizens willing to ask annoying questions.
Citizens willing to challenge assumptions.
Citizens willing to stand in hallways holding paperwork.
Even when they lose.
Even when the system barely notices.
Even when history forgets the moment entirely.
These documents now feel less like attacks on individuals and more like attempts to stress-test democratic process itself.
Could the rules survive scrutiny?
Could election systems withstand citizen examination?
Could ordinary people meaningfully challenge institutional momentum?
Or were the outcomes largely predetermined by political gravity?
That question still matters.
Especially now.
Because modern politics increasingly trains citizens to become spectators instead of participants.
Consumers instead of investigators.
Cheerleaders instead of challengers.
The old paper wars on Grant Street remind us that democracy can still be touched physically.
Stamped.
Filed.
Questioned.
Objected to.
Argued over.
Verified.
Messy democracy may actually be healthier than passive democracy.
And perhaps the deeper point was never whether a particular petition succeeded or failed.
The deeper point was that citizens still believed the system could be confronted directly.
That belief may be rarer today than many people realize.
Ethics complaints from back in the day
PDFs of the three complaints sent to the Ethics Hearing Board in its infancy:
.jpg)
Wednesday, May 27, 2026
Thursday, May 21, 2026
Fwd: ❇️ LifeguardEye Webinar Recording: A Rare Discussion with Aquatic Operators Using AI
From: LifeguardEye <mark@lifeguardeye.com>
Date: Thu, May 21, 2026 at 7:29 AM
Subject: ❇️ LifeguardEye Webinar Recording: A Rare Discussion with Aquatic Operators Using AI
To: <mark.rauterkus@gmail.com>
|
Click here to unsubscribe from this campaign. |
Wednesday, May 20, 2026
Fwd: Speak out against the 'Future Ready Plan'
To: <sarahzangle@gmail.com>
Cc: Michael T. Cummins Jr. <mtcummins@gmail.com>
I’m putting out a quiet call to other website owners, developers, hosting admins, and WordPress people.
I’m dealing with a brutal website security mess across several small WordPress sites, and I’m trying to compare notes with others who manage hosting accounts, WordPress installs, cPanel-style environments, or Google Search Console properties.
The pattern is ugly: under-the-hood malware, fake AMP pages, Google Search Console “AMP page domain mismatch” warnings, surprise ownership verification attempts, changed index.php files, rewritten robots.txt files, strange PHP loaders, and remote scripts aimed mostly at search bots rather than normal visitors.
I am not claiming I know the root cause yet. It could be compromised WordPress installs, bad plugins, stolen credentials, web shells, hosting-layer exposure, or something farther upstream. But the symptoms are repeating across enough places that I want to ask plainly:
Are other webmasters seeing this too?
Especially:
- Fake AMP pages tied to domains you control
- Google Search Console ownership you did not add
- index.php files altered to serve different content to Googlebot
- robots.txt or sitemap files rewritten
- PHP files calling strange outside domains
- Malware recurring after local cleanup
Security people often do not want to discuss details in public, and I respect that. But if you are seeing similar patterns, I’d like to compare notes privately.
This is the kind of thing that makes you want to scream because the public-facing site may look normal while the damage is happening underneath.
Photo from a past CodeFest event -- where we won an award. I'm on the far left.
Friday, May 15, 2026
Fwd: It's race week — and we're bringing Dual Boards to the pool 🏊♂️
From: Jose Gallagher <josegallagher@ripcurrentsports.com>
Date: Fri, May 15, 2026 at 11:07 AM
Subject: It's race week — and we're bringing Dual Boards to the pool 🏊♂️
 |
Posts
