Malware in a WordPress backup, disguised as a photo A client wanted me to restore a WordPress site from a zip backup and asked for one thing before paying: a screenshot of the site running on my own computer, with localhost in the address bar.

Loading a WordPress site runs its PHP on whatever machine serves it. So I read the zip with a script first and didn't extract it.

WordPress core matched the official checksums. In wp-content/mu-plugins, though, there was a file that looked for a 4.6 MB "JPEG" in uploads, renamed it to .exe and tried nine ways to launch it. The first two bytes of that "JPEG" were MZ, which is how a Windows executable starts. Opening localhost for the screenshot would have been enough to run it.

My first script missed it because it trusted file extensions. Now it reads the first bytes of every file.

The write-up has the loader code and the checks I now run before importing a backup I didn't make. If the same file reached you, the SHA-256 hashes are at the end. https://helban.dev/en/case-studies/fake-wordpress-backup-malware/

The MZ check is such a good catch. Worth adding for anyone restoring sites: mu-plugins run on every request and can't be switched off from the dashboard, so they're a favourite hiding spot. Did the client ever reply after you flagged it?

ClubTree | All-in-One Membership Management SaaS

Designed and developed ClubTree, a SaaS platform that helps membership organizations manage their websites, members, events, and communications from one centralized system.

ClubTree combines a public-facing website with an administrative dashboard, giving organizations the tools to manage membership applications, member directories, attendance, newsletters, documents, and organizational workflows.

The platform was designed around real-world service club needs, with an emphasis on intuitive navigation, role-based access, and simplifying administrative tasks.

My role: Product strategy, user research, UI/UX design, full-stack development, testing, and launch.

Key features:

- Membership applications and directories

- Event and attendance management

- Website content management

- Newsletters and member communications

- Role-based access and administrative dashboards

- Integrated organizational workflows

Outcome: A functional membership management platform with a live implementation for the Rotary Club of Charlottesville.

Going live with one real club in Charlottesville and building around how they actually run is the right way to do it. Club admin tools usually feel stuck in 2010, so this looks like a big upgrade. How did you land them, through someone in the club?