Practical security insights for teams without a SOC

No vendor fluff. No recycled threat reports. Real guidance on vulnerability scanning, malware, and attack surface management — written by practitioners.

o

Obaida Al-Sulaiman

Information Security Manager · CISSP · CEH · OSCP

Vulnerability Scanning

What Is Network Vulnerability Scanning? How It Works, What It Finds ?

Network vulnerability scanning is the automated process of probing every host on a network, identifying the service behind each open port, and matching what it finds against a database of known vulnerabilities. It is the cheapest reliable way to see your infrastructure the way an attacker sees it. It is also widely oversold. A scan […]

Obaida Al-Sulaiman
9:23 am

Vulnerability Scanning

Internal vs External Vulnerability Scanning: What Each One Finds?

Internal and external vulnerability scanning are the same technique pointed in two different directions. External scanning tests your internet facing addresses from outside the perimeter. Internal scanning tests what is reachable once someone is already inside. The comparison gets explained badly almost everywhere, usually by bundling in credentials, tooling, and intent that have nothing to […]

Obaida Al-Sulaiman
9:20 am

Vulnerability Scanning

How to Fix a Hacked WordPress Site: A Step-by-Step Recovery Guide

If your WordPress site has been hacked, the fastest way to fix it is to work in order rather than panic: contain the site, find and remove the malware, close the vulnerability that let the attacker in, then harden against a repeat. This guide walks through how to fix a hacked WordPress site step by […]

Obaida Al-Sulaiman
12:35 pm

Vulnerability Scanning

How to Check a WordPress Version in Database (Accurately)

Learning how to check a wordpress version in database is useful when you are locked out of the dashboard, but it comes with a catch most guides get wrong: the version is not stored as a plain row. What the database holds is the db_version schema number and a cached core-update record whose version_checked field […]

Obaida Al-Sulaiman
12:12 pm

Vulnerability Scanning

How to Check WordPress Version Without Logging In ? (2026 Methods)

Learning how to check WordPress version without login often takes only a couple of minutes because default or lightly hardened WordPress sites may expose version clues in the page source, RSS feeds, asset URLs, and public files. Knowing the version can help with security auditing because automated tools use the same public clues for reconnaissance. […]

Obaida Al-Sulaiman
12:04 pm

Vulnerability Scanning

WordPress File Upload Vulnerabilities: How Attackers Get RCE, and How to Stop Them

A WordPress file upload vulnerability is one of the most dangerous flaws a site can have, because it can lead straight to remote code execution when an attacker can place an executable file in a web-accessible location where the server will run it. These flaws live almost entirely in plugins and themes that accept uploads […]

Obaida Al-Sulaiman
2:16 pm

Vulnerability Scanning

WordPress SQL Injection: How It Works, Real CVEs, and How to Prevent It

WordPress SQL injection is one of the most damaging ways a WordPress site gets breached, because it reaches the database where everything lives: your users, passwords, settings, and content. The WordPress core is well protected against it, and most real cases trace back to insecure plugin or theme code rather than WordPress itself. This guide […]

Obaida Al-Sulaiman
2:12 pm

Vulnerability Scanning

WordPress Plugin Vulnerabilities: The 2026 Data, Real CVEs, and How to Stay Safe

WordPress plugin vulnerabilities are the single biggest reason WordPress sites get hacked, and the problem is growing, not shrinking. Plugins account for more than nine in ten WordPress security flaws, the core almost none, and some heavily exploited newly disclosed plugin bugs are now mass-exploited within hours. This guide covers what plugin vulnerabilities are, the […]

Obaida Al-Sulaiman
2:09 pm

vulnerability statistics

API Security Statistics 2026: Attacks, Breaches & Data

API security statistics are becoming harder to interpret as APIs spread across web applications, mobile apps, microservices, SaaS integrations, artificial intelligence systems, and machine-to-machine workflows. The strongest 2026 data does not point to one universal “API attack rate.” It shows several different problems moving together: more API-related incidents, rapid API growth, weak visibility into sensitive […]

Obaida Al-Sulaiman
11:46 am

vulnerability statistics

Ransomware Statistics 2026: Verified Attack & Cost Data

Ransomware statistics can look contradictory because attack volume, breach involvement, encryption, ransom demands, payments, recovery costs, and leak-site claims measure different parts of the same problem. The latest 2026 evidence shows a clear pattern: ransomware is involved in more breaches, more attacks reach encryption, and the criminal ecosystem is fragmenting, while a larger share of […]

Obaida Al-Sulaiman
11:38 am

vulnerability statistics

Vulnerability Statistics 2026: CVEs, KEV & Exploitation Data

Vulnerability statistics are easy to inflate because raw disclosure volume is the biggest number and often the least useful one on its own. The CVE Program published 48,244 vulnerabilities in 2025, while confirmed exploitation remains concentrated in a much smaller set. In 2026, the more important story is the widening gap between attacker speed and […]

Obaida Al-Sulaiman
1:19 pm

vulnerability statistics

Small Business Cybersecurity Statistics 2026: Verified Data

Small business cybersecurity statistics are easy to inflate because surveys, investigated breaches, blocked attacks, ransomware incidents, and financial-loss estimates all measure different things. The clearest 2026 picture is more useful than the viral numbers: smaller organizations stop fewer ransomware attacks before damage, vulnerability exploitation leads breach entry in Verizon’s SMB dataset, third parties appear in […]

Obaida Al-Sulaiman
1:18 pm

Load more articles

Vulnerability Scanning

Internal vs External Vulnerability Scanning: What Each One Finds?

Internal and external vulnerability scanning are the same technique pointed in two different directions. External scanning tests your internet facing addresses from outside the perimeter. Internal scanning tests what is reachable once someone is already inside. The comparison gets explained badly almost everywhere, usually by bundling in credentials, tooling, and intent that have nothing to […]

Obaida Al-Sulaiman
9:20 am

Vulnerability Scanning

How to Fix a Hacked WordPress Site: A Step-by-Step Recovery Guide

If your WordPress site has been hacked, the fastest way to fix it is to work in order rather than panic: contain the site, find and remove the malware, close the vulnerability that let the attacker in, then harden against a repeat. This guide walks through how to fix a hacked WordPress site step by […]

Obaida Al-Sulaiman
12:35 pm

Vulnerability Scanning

How to Check a WordPress Version in Database (Accurately)

Learning how to check a wordpress version in database is useful when you are locked out of the dashboard, but it comes with a catch most guides get wrong: the version is not stored as a plain row. What the database holds is the db_version schema number and a cached core-update record whose version_checked field […]

Obaida Al-Sulaiman
12:12 pm

Vulnerability Scanning

How to Check WordPress Version Without Logging In ? (2026 Methods)

Learning how to check WordPress version without login often takes only a couple of minutes because default or lightly hardened WordPress sites may expose version clues in the page source, RSS feeds, asset URLs, and public files. Knowing the version can help with security auditing because automated tools use the same public clues for reconnaissance. […]

Obaida Al-Sulaiman
12:04 pm

Vulnerability Scanning

WordPress File Upload Vulnerabilities: How Attackers Get RCE, and How to Stop Them

A WordPress file upload vulnerability is one of the most dangerous flaws a site can have, because it can lead straight to remote code execution when an attacker can place an executable file in a web-accessible location where the server will run it. These flaws live almost entirely in plugins and themes that accept uploads […]

Obaida Al-Sulaiman
2:16 pm

Vulnerability Scanning

WordPress SQL Injection: How It Works, Real CVEs, and How to Prevent It

WordPress SQL injection is one of the most damaging ways a WordPress site gets breached, because it reaches the database where everything lives: your users, passwords, settings, and content. The WordPress core is well protected against it, and most real cases trace back to insecure plugin or theme code rather than WordPress itself. This guide […]

Obaida Al-Sulaiman
2:12 pm

Vulnerability Scanning

WordPress Plugin Vulnerabilities: The 2026 Data, Real CVEs, and How to Stay Safe

WordPress plugin vulnerabilities are the single biggest reason WordPress sites get hacked, and the problem is growing, not shrinking. Plugins account for more than nine in ten WordPress security flaws, the core almost none, and some heavily exploited newly disclosed plugin bugs are now mass-exploited within hours. This guide covers what plugin vulnerabilities are, the […]

Obaida Al-Sulaiman
2:09 pm

Vulnerability Scanning

How to Secure Joomla Website: A 2026 Hardening Guide

Learning how to secure Joomla website comes down to a short list of controls applied in the right order, not a hundred obscure tweaks. Patch first, lock down the login, apply least privilege, force HTTPS, harden the server, cut your extension count, and scan on a schedule. Most hacked Joomla sites fall to one skipped […]

Obaida Al-Sulaiman
11:48 am

Vulnerability Scanning

Joomla vs WordPress Security: An Evidence-Based 2026 Comparison

The Joomla vs WordPress security debate usually gets answered with loyalty, not evidence. The honest version is duller and more useful: both platforms ship a secure core, and both get breached through third-party code far more than through a core bug. Joomla bundles more security controls by default, while WordPress patches its core faster and […]

Obaida Al-Sulaiman
11:56 am

Vulnerability Scanning

Joomla Security Features: What the Core Actually Ships in 2026

Joomla security features are one of the platform’s real advantages: the core ships controls that most content management systems leave to plugins. Out of the box you get two-factor authentication, granular access control, forced HTTPS, input filtering, and a dedicated Security Strike Team behind the code. This guide walks through every built-in feature Joomla 4, […]

Obaida Al-Sulaiman
11:47 am

Vulnerability Scanning

Is Joomla Secure? An Honest 2026 Security Assessment

Is Joomla secure in 2026? Yes, when it runs on a supported release and is maintained properly. Joomla includes multi-factor authentication, granular access control, security-header tooling, and a dedicated security-response team, but those controls do not make an outdated site safe. The August 2026 release fixed an MFA bypass, access-control flaws, XSS, CORS validation issues, […]

Obaida Al-Sulaiman
10:42 pm

Vulnerability Scanning

Joomla SQL Injection: How It Works, Real CVEs, and How to Prevent It

Joomla SQL injection is one of the oldest and most damaging ways an attacker takes over a Joomla site, and it is still live in 2026. A single unfiltered parameter can let an attacker read your database, dump password hashes, or forge an administrator session. Joomla core has been patched against several critical cases over […]

Obaida Al-Sulaiman
10:37 pm

Load more articles

Written by

o

Obaida Al-Sulaiman

Information Security Manager, Dubai

12+ years in information security. Specialises in web application security, vulnerability management, and external attack surface reduction for SMB and mid-market organisations.

Browse by topic

Browse by topic

New CVEs, practical guides, and scan methodology updates. One email per week. No sales pitch.

No spam. Unsubscribe any time. GDPR compliant.

Editorial standards: All ScanTitan blog content is reviewed by certified InfoSec professionals before publication. Technical claims are tested against live scan results or cited from primary sources (CVE database, OWASP, NIST NVD). We do not accept sponsored posts or paid placements.

Try a free scan

Run a free vulnerability scan on your domain. No account required.

Loading posts...