Website defacements: patching, MDR and backup that close the gap

Most public-sector website compromises in the Philippines start with a known, unpatched weakness and go unnoticed until the attacker announces them. Patch management closes the weakness, managed detection and response (MDR) catches what gets through, and immutable backup lets you recover when both fail.

The short answer

Defacements are the visible symptom. The underlying problems are an exposure window that stays open too long, nobody watching the systems that matter, and no clean copy of data to restore from. Each needs its own control: patch management to shrink the window, AI-powered MDR to shorten the time an attacker can work unseen, and business continuity and disaster recovery (BCDR) to make recovery a matter of hours.

What the recent incidents have in common

In a single weekend in September 2025, the Department of Information and Communications Technology (DICT) confirmed that 19 government websites had been defaced, and at least 11 of them belonged to local government units. In June 2026, the Senate and House of Representatives websites were defaced within days of each other, prompting the Philippine National Police to urge agencies to check their digital defences.

The September 2026 incidents went further. DICT described an unauthorised modification on the Department of Labor and Employment's web host, alongside unauthorised access at the Department of Migrant Workers. The group behind the DMW intrusion claimed more than a month of access to internal systems, and the breach became public through the attackers' own announcement rather than through detection. The same agency had earlier been forced back to manual, paper-based processing after a ransomware incident.

Three failures repeat across these cases: an entry point that should have been closed, an intrusion nobody saw, and a recovery that took far longer than it should have.

Why WordPress keeps appearing

Many government and SME websites run on WordPress, and its plugin ecosystem is where most of the risk sits. In August 2026, researchers traced data stolen from a Philippine marine engineering contractor serving the Navy to CVE-2024-28000, a privilege-escalation flaw in the LiteSpeed Cache plugin that had been patched in 2024. The attacker also brute-forced the admin password over XML-RPC using a public wordlist.

2026 has added more. CVE-2026-23550 in the Modular DS plugin (CVSS 10.0) and CVE-2026-8732 in WP Maps Pro (CVSS 9.8) were both exploited in the wild to create rogue administrator accounts. The pattern is consistent: the fix exists, but the site has not applied it.

Patch management: closing the exposure window

Patching only works when it is continuous and visible. A spreadsheet of servers and a monthly reminder does not tell you which device is still exposed today. Sulsivo, Onprem2Cloud's own multi-tenant patch management platform, is built around that visibility:

• A lightweight agent reports each Windows device's missing updates and installed software to a central console.
• A compliance view per organisation shows devices missing updates, devices waiting for a reboot, devices that have stopped reporting and devices never scanned.
• Engineers approve which updates to install, and the agent rescans afterwards so the inventory stays current.
• Every task sent to a device is cryptographically signed, so the agent acts only on verified instructions meant for that device.
• Each client's devices and data are kept separate from every other client's.

Web applications need the same discipline. Keep CMS core, themes and plugins on a defined update cadence, remove plugins that are no longer used, and disable XML-RPC if nothing depends on it.

AI-powered MDR: shortening dwell time

Patching reduces the attack surface but cannot stop zero-days, stolen credentials or misconfiguration. Managed detection and response watches for the behaviour that follows a successful intrusion:

• Continuous, AI-driven monitoring of endpoint and identity activity, 24 hours a day, including the hours when no analyst is on shift.
• Security analysts who review and act on what the AI escalates.
• Detection of persistence, privilege escalation, rogue account creation and lateral movement.
• Host isolation and guided remediation once an incident is confirmed.
• Incident reports suitable for management review and regulatory follow-up.

The DMW case shows the cost of the alternative: an attacker with more than a month inside, discovered only when they chose to say so.

Commvault Cloud BCDR: recovering without paper

When an incident does land, the question is how quickly operations resume. Onprem2Cloud is an official Commvault partner and delivers Commvault Cloud as a SaaS service:

• Backup and recovery for Microsoft 365 (Exchange, SharePoint, OneDrive and Teams), Entra ID and Active Directory, and endpoints.
• Air-gapped, immutable backup copies kept separate from production, so ransomware and compromised admin accounts cannot reach them.
• Granular and point-in-time restores, from a single mailbox item to a full environment.
• No backup infrastructure to deploy or maintain on premises.

A practical order of work

1. Inventory every internet-facing system, including websites, and record who owns each one.
2. Bring operating systems and applications up to date, starting with vulnerabilities known to be exploited.
3. Update or remove every CMS plugin and theme, and enforce strong, unique admin passwords with multi-factor authentication.
4. Put endpoints and identities under continuous MDR monitoring.
5. Back up Microsoft 365, identity and endpoint data to an immutable, separate copy, and test a restore.
6. Review the patch compliance view every week and treat stale or never-scanned devices as open findings.

Frequently asked questions

What is the difference between patch management and MDR?

Patch management removes known vulnerabilities before they are exploited. MDR detects and responds to attacks that get through anyway, including those using stolen credentials or flaws with no patch yet. Most organisations need both.

Is a defaced website a data breach?

Not always. A defacement proves the attacker could change content on the web host, which often means they could reach more. Treat it as a possible breach until logs and an investigation show otherwise.

How often should WordPress plugins be updated?

Check for updates at least weekly and apply security releases as soon as they are published. Plugins with actively exploited flaws should be updated or disabled the same day.

Does Microsoft 365 need a separate backup?

Yes. Microsoft keeps the service running, but recovering from deletion, ransomware or a compromised admin account is the customer's responsibility under the shared responsibility model. A separate, immutable backup covers that gap.

Can LGUs and small agencies afford managed security?

Managed services are priced per device or per user, so a small LGU pays for the endpoints and mailboxes it has, without building a security operations centre of its own.

Where to start

Onprem2Cloud IT Solutions Co. is a Microsoft CSP partner and official Commvault partner based in Muntinlupa City, Metro Manila. We provide Sulsivo patch management, AI-powered MDR and Commvault Cloud BCDR for LGUs, government agencies and private organisations. See our cybersecurity services, read how unmanaged laptops put company data at risk, or request a security posture assessment.