Projeto Coleta (Nota Solidária)
A new project, also hosted on space.fast. The project page explains what it is, and the live site is one click away.
IN PROGRESS just startedbuild_log
This website
Cleaner layout, links to my old work, and a lot of tape. Posts show up as I finish (or abandon) things.
IN PROGRESS v4 (lol)Elderward
Free, GPL malware scanner and incident-response plugin for WordPress. One report-only scan checks uploads, core, plugin and theme files, database entries, access logs, known signatures and the crontab without changing anything. It also has custom signatures, server hardening rules, a recovery mode for when WordPress won't load, and WP-CLI plus a standalone script for cleanup. Publicly released during WordCamp Brasil 2026. Not on WordPress.org yet.
Plugin gratuito (GPL) de scanner de malware e resposta a incidentes para WordPress. Um scan somente de leitura verifica uploads, arquivos do núcleo, plugins e temas, entradas no banco de dados, logs de acesso, assinaturas conhecidas e o crontab, sem alterar nada. Também tem assinaturas personalizadas, regras de hardening no servidor, modo de recuperação para quando o WordPress não carrega, e WP-CLI mais um script standalone para limpeza. Lançado publicamente no WordCamp Brasil 2026. Ainda não está no WordPress.org.
FREE + GPL GRÁTIS + GPL always dryrun firstImproved WP Site Health
A must-use plugin prototype that adds a Hardening tab to WordPress Site Health. It closes risky features by default, like a firewall for features, and lets the site owner open them on purpose. Three postures (Locked, Standard, Open), eleven dials, nine new Site Health tests, and drift detection that flags anything switched closed but still open. The README calls it “a spike, not a release”: meant to be read and argued about. It grew out of a discussion at the Collaboration Day of WordCamp Brasil 2026.
Protótipo de plugin must-use que adiciona uma aba Hardening ao Site Health do WordPress. Ele fecha por padrão recursos arriscados, como um firewall para recursos, e deixa o dono do site abri-los de propósito. Três posturas (Locked, Standard, Open), onze controles, nove novos testes do Site Health e detecção de desvio que marca como crítico o que foi fechado mas continua aberto. O README diz que é “a spike, not a release”: feito para ser lido e discutido. Nasceu de uma conversa no Dia de Colaboração do WordCamp Brasil 2026.
PROTOTYPE PROTÓTIPO a spike, not a releaseA Voz que Ecoa no Verde
Minha campanha de Call of Cthulhu, ambientada na ditadura militar brasileira dos anos 70. Os posts sobre ela vão ser em português do Brasil. Ainda não tem nada publicado.
EM ANDAMENTO sem spoilersRegexDebugger
A regex tester inspired by Regex101. It highlights matches and capture groups live, fills a match table, and explains the pattern in plain English. Besides JavaScript, it supports a YARA-X flavor that runs the official engine as WebAssembly. For that flavor it analyzes the atoms the engine searches for and grades the regex Fast, OK or Slow, with rewrite suggestions. No backend: it builds to a static site (TypeScript, React, Vite).
ORIGINAL slow regex, begonePHPDeobfuscator
My fork of simon816/PHPDeobfuscator, a tool that reverses common PHP obfuscation: constant folding, whitelisted functions like base64_decode, nested eval unwrapping and control-flow cleanup. The README also describes an opt-in sandboxed mode for resolving decoder functions. On my side I have been improving the researcher guide, including a walkthrough on inlining named functions.
php-eval-hook
My fork of extremecoders-re/php-eval-hook, a PHP extension that hooks eval(). Every eval calls a user-defined __eval callback, which can print the code, save it, replace it or block it. Handy for dumping the real payload from eval-obfuscated malware. The README targets PHP 7.x and is MIT licensed.
waffle-makers-yara-x
My fork of VirusTotal/yara-x, the Rust rewrite of YARA that aims to be faster, safer and friendlier. Upstream docs live at virustotal.github.io/yara-x. Yes, the name involves waffles.
FORK waffles optionalOld malware write-ups at Sucuri
30 posts on website malware, backdoors, phishing and injections. They're old, and I'm still proud of them.
ARCHIVED vintageResearch notes, unpolished
Short write-ups, findings and half-formed ideas worth sharing before they're perfect.
PLANNED TODO: actual notesMy talk at Mind the Sec 2026
Technical track at Mind the Sec 2026, on 14 September, in Portuguese: “WP2Shell - O impacto da IA em vulnerabilidades 0-day e a importância da divulgação responsável”. Per the event page, it covers how the WP2Shell vulnerability was received, identified and verified, and the challenge of shipping timely fixes and protections for more than 500 million sites.
WRITE-UP PENDING notes + slides laterSide quests & interesting finds
Links, experiments and things that caught my attention for no productive reason.
OPEN
NOTE TO SELF
Don't wait until it's "ready". Post the messy version, fix it live, keep the tape visible.
sucuri_archive
Posts I wrote for the Sucuri blog between 2012 and 2019. Old threats, old techniques, still fun to read. Everything lives on the author page.
2014(12 posts)
- Malvertising on a Website Without Ads
- Typos Can have a Bigger Impact Than Expected
- Malvertising Payload Targets Home Routers
- Website Malware – Curious .htaccess Conditional Redirect Case
- Conditional Malicious iFrame Targeting WordPress Web Sites
- Website Security – Compromised Website Used To Hack Home Routers
- Microsoft IIS Web Server – CMD Process Contributing to Website Reinfections
- Phishing Tale: An Analysis of an Email Phishing Scam
- Analyzing a Malicious iFrame – Following the Eval Trail
- Highly Effective Joomla Backdoor with Small Profile
- Malicious iFrame Injections Host Payload on Tumblr
- The Hidden Backdoors to the City of Cron