ALL WORD PRESS SITES HACKED

you don’t say who your host is or much details.
Almost all of the hacks lately have come from static sites on shared servers where all index files get hacked.

Some details:

The host is HostGator
The hack:
somehow, DZ-Ghost uploaded a php shell file
then from that point – they went thru and changed all of the index files
(like samboll stated)

I dont know how – but it appears, from the logs; that a 404.php was uploaded

What bothers me – is that if someone can upload that kind of php/shell – what’s stopping them from uploading Haxplorer and really doing some damage

Mostly I just would like to know – how they uploaded anything – so I can become better at security……..

a php shell is as good rooting the box. have you ever looked at what a c99 shell or similar can do?? one word: evil

haxplorer has nothing on a good php shell

https://video.google.com/videosearch?hl=en&ie=UTF-8&q=c99%20shell&sa=N&tab=wv&um=1#

as to how .. theres no telling from where everyone but you sits.