CERBEROS.

Every breach
has a file.

Cerberos watches small-business websites around the clock, finds the weak spots and fixes them before an attacker can use them.

Exhibit A. A bakery's website, last updated in 2021.Three outdated parts, readable by anyone

Case 001 is an illustrative reconstruction.

Tuesday, 02:14:07

I. First contact

It didn't guess. It read.

  1. An automated AI agent opens mira-bakery.example. It works through sites like this one all night.

  2. It reads the page source, the same text every browser receives. Three version numbers are sitting in it.

  3. It looks them up. The contact form plugin has a flaw that was published, with a description, years ago.

  4. It writes a request that uses the flaw. No password needed.

  5. It is in. It can change the site, read every order, or quietly add a fake payment page.

Illustrative. The method is documented in public research.1

Exhibit A, 02:14 to 02:18

4 minutes
12 seconds.

From first visit to full control. Nobody was watching.

II. What would have seen it

It was visible 41 days earlier.

Cerberos reads your website the way an attacker does: every page, every version number, every day. The difference is what happens next.

  1. WordPress 5.8 flagged. Two years of security updates missing.

  2. contact-form 2.1.0 flagged. A published flaw, the one used in chapter I.

  3. slider 1.3.0 flagged. Nobody maintains it any more.

Day 1, 09:00

III. Found, then fixed

Every finding comes with its fix.

A report full of red is not security. We fix what we find, then check again that the fix held.

Findings for Mira Bakery, an illustrative case, and what was done about each
FindingWhat it means for youWhat we didStatus
WordPress 5.8 Its published flaws apply to your site, and anyone can look them up. Updated to the current release. The version number no longer shows on the page. Fixed, day 1, 10:05
contact-form 2.1.0 The exact flaw used in chapter I. Updated to 2.4.3 and the form tested again. Fixed, day 1, 10:40
slider 1.3.0 Nobody maintains it, so its next flaw will never be fixed. Replaced with a maintained gallery. Fixed, day 1, 14:15
Staff login open to everyone Password guessing can run day and night, unnoticed. Login limited, and two-step sign-in turned on for every account. Fixed, day 2, 09:30
Certificate expires in 12 days Browsers would warn your customers away from your site. Renewal automated, and checked again. Fixed, day 2, 09:45

Keep your file empty.