shared hosting
6 articles with this tag
Unauthorized Access to Some ConoHa WING (GMO Internet) Web Servers (426 Accounts): Data in Customers' Web Server Areas Affected, and What Site Owners Should Do Today
On September 20, 2026, GMO Internet, Inc. announced that on some hosting servers (web servers) of its ConoHa WING rental hosting service, a third party had gained unauthorized access to the web server areas of some customers and installed a malicious program. 426 accounts are affected, and the data concerned is 'data stored in customers' web server areas'. The access and installation began on September 3; the company detected it on September 16, and on September 18 identified the cause and scope and removed the programs. It says it has identified the cause but has not disclosed it. Member, contract and payment data are managed in a separate environment and were not leaked, it says. The notice does not say whether data in the web server areas was taken. Affected customers were contacted individually at their registered email address, and customers who were not contacted are not affected. There was no follow-up notice as of October 15. This site's take: first check whether you received an individual email and, if so, follow its instructions. Then treat the credentials kept in your web server area (the database password in wp-config.php, API keys in .env and so on) as read and change them, and look for files, administrators and scheduled jobs added since September 3.
How to check if your website or server was hacked: step-by-step checks for shared hosting, WordPress and a VPS, and what to do first if you find something
Checking a site for intrusion means looking at both the signs visible from outside and the traces left inside. Signs: Search Console's Security issues report, a 'This site may be hacked' label in search, a notice from your host, unknown admins, redirects that happen only on mobile or from search. Traces: admin users, modified core files (wp core verify-checksums), login history, authorized_keys, cron, listening ports, recently changed files. This site's view: finding nothing does not prove you are clean. If you do find something, preserve evidence before cleaning, rotate every credential from a clean device, restore from a pre-intrusion backup or rebuild, close the entry point, and only then request a review.
When Your Web Hosting Provider Is Breached: What Customers Should Do
A provider-side compromise cannot be blocked by customer settings, so the defense shifts from prevention to limiting how much you can lose. The 10 September investigation results established the part that matters most: unauthorized access to the sales management system occurred between April 2023 and March 2026, the affected hosting accounts rose from 583 to 951, and some initial passwords were not hashed. This site's view: treat everything on shared hosting as readable, push secrets, credentials and backups outside the provider, and change any initial password you are still using today.
Did you leave a secret file in a public directory? Audit your webroot
Anything in your webroot is fetchable by URL by anyone. A leftover token/credential JSON, .env, or backup means instant exposure — and if it came from a shared template, every site has the same file. Fix: put only publicly-shareable things in the public dir, keep secrets outside the webroot at perms 600, and once you find one, audit every site and host.
A case where Laravel's .env was publicly readable: a shared-hosting placement mistake and how to fix it
The cause: the whole app sat under the web root; only public/ should be visible. Fix in three steps — a temporary .htaccess block, rotate keys, restructure — then prevent it with process.
Keeping .env off the public web on shared hosting
The main fix: app body outside the docroot, only public/ exposed. Block access with .htaccess first, make it permanent by restructuring, then self-check. This site's view: this isn't one person's slip but a dangerous layout that became standard across the industry — fix it with process, not vigilance. bootstrap-redirect beats symlink.