Proposal

Leave Pair.
Launch on Cloudflare.

Four breaches in six months on shared hosting. A system that replaces it all — from closing a deal to a live, secure client website in minutes, powered by Emergent and Cloudflare.

From Talmage
For Jed / Talking Heads
Date May 2026
01 — The Situation

Six months. Four breaches.

This is the real history of the Pair Networks shared VPS that hosts talkingheads.com, websitetalkingheads.com, and client sites like mukbuddy.com. Every one of these happened.

December 2025
WordPress backdoors & webshells
Multiple PHP backdoors planted across site roots. Rogue admin accounts created. Unauthenticated file upload handlers found wide open. File manager plugins abused for persistence. Required quarantining dozens of files, reinstalling WordPress core on 7 sites, demoting unknown admin accounts, and locking down upload directories.
April 10–12, 2026
Reverse shell & remote access compromise
Attacker gained unauthenticated remote code execution via a WSO webshell with spoofed file timestamps. Within minutes the URL was shared in an attacker Telegram channel. A second attacker joined. They pivoted across vhosts and launched a gsocket reverse shell — giving them persistent interactive access to the server. Pair locked the entire account.
April 23, 2026
Reinfection — backdoor survived cleanup
After the April incident was "cleaned up," we discovered the attacker's binary was still running. Three persistence mechanisms survived: a base64-encoded cron job disguised as a system process, and payloads injected into login scripts. The attacker had continuous shell access for 10 days after the cleanup was declared complete.
May 4, 2026
SEO spam injection
Indonesian gambling spam pages dropped into websitetalkingheads.com via FTP. The malware scanner detected them but had no alerting pipeline — it wrote to a log file nobody checked. The spam was live for 4 days before manual discovery.
02 — The Real Cost

What it takes to keep Pair alive

After each incident, we built more defenses. Here's what's running right now just to keep the shared VPS from getting popped again:

22
Security scripts
2,937
Lines of bash
5
Scheduled cron jobs
12+
Credentials rotated

Daily malware scans, file integrity baselines, new-file monitors, heartbeat watchdogs, external health checks, Slack alerting, Wordfence WAF, .htaccess lockdowns, PHP function restrictions, FTP password rotations, database credential rotations, WordPress salt rotations, admin account audits — all to defend a platform that was breached five times in six months.

And the fundamental problem remains: Pair is shared hosting running WordPress with PHP. Other accounts on the same VPS are attack surface you can't control. Every WordPress plugin is a potential entry point. Every PHP endpoint is a potential shell. Every credential on disk is one webshell away from being exfiltrated.

03 — The Fix

Kill the server.
Eliminate the attack surface.

The answer isn't better security on Pair. The answer is removing the things that get attacked. Static sites on Cloudflare Pages have no server, no PHP, no database, no shared hosting neighbors, and no credentials on disk. There is nothing to compromise.

Everything we've been defending against — gone:

No PHP — no webshells, no RCE
No database — no credentials to leak
No shared VPS — no neighbor risk
No FTP — no password-spray vector
No WordPress — no plugin vulns
No server processes — no reverse shells
No file uploads — no malware drops
No cron jobs — no persistence mechanisms
No .htaccess — no config drift
No directory listings — no source exposure

We've built a CLI toolkit called th-infra that handles the entire infrastructure layer: domain registration, site hosting, media storage, DNS, and SSL — all on Cloudflare. You describe the client's site to Emergent, same as you do now. Emergent builds whatever you ask for. When the site is ready, it calls our tools and it's live in under a minute.

Pair + WordPress
Shared VPS with other accounts
PHP + MySQL + FTP attack surface
22 security scripts running daily
Manual credential rotation after every breach
SSL requires manual setup
No DDoS protection
Four breaches in six months
Cloudflare Pages
Isolated, serverless — nothing to breach
Static files only — zero attack surface
Zero security scripts needed
One API token, stored locally
SSL automatic, always strict
Enterprise-grade DDoS, free, always on
Global CDN, 300+ edge locations
04 — The Workflow

Five commands from zero to live

Here's what Emergent does after you say "set up a site for Acme Corp at acme-corp.com":

1

Check & register the domain

Checks availability, shows the price, and registers it. DNS zone and SSL are configured automatically.

th-infra domain buy acme-corp.com
2

Create the hosting project

Spins up a Cloudflare Pages project. The site gets a free staging URL immediately.

th-infra site create acme-corp
3

Build and deploy

Emergent builds whatever site you described — any framework, any design. Then deploys it with one command.

th-infra site deploy acme-corp ./dist
4

Set up media storage

Creates an R2 bucket for videos, images, and assets. Uploads everything.

th-infra media create acme-corp
5

Connect domain to site

Wires the domain to the Pages project. CNAME records, custom domain registration — all handled.

th-infra site connect acme-corp acme-corp.com
05 — Live Demo

This already works

We tested every command against a live Cloudflare account. Here's an actual run — real API responses, not mockups.

th-infra — live test run
# Check if a domain is available
th-infra domain check test-acme-demo.com
test-acme-demo.com is available
Register: $10.46/yr — Renew: $10.46/yr
# Create a Pages project
th-infra site create th-infra-test
Project 'th-infra-test' created
URL: https://th-infra-test.pages.dev
# Deploy a site
th-infra site deploy th-infra-test ./dist
Live at https://th-infra-test.pages.dev
# Create media storage
th-infra media create th-infra-test
Bucket 'th-infra-test-media' created
# Upload assets
th-infra media upload th-infra-test ./assets
Uploaded 1 file(s) (0.0 MB)
# Check project health
th-infra status th-infra-test
Pages: https://th-infra-test.pages.dev (deployed)
Domain: not connected
Media: th-infra-test-media
# Verified live: HTTP 200
curl -sI https://th-infra-test.pages.dev | head -1
HTTP/2 200
06 — Costs

Almost free

Cloudflare's pricing model is uniquely generous. Most of what we use costs nothing.

Service Cost Notes
CF Pages (hosting) Free 500 deploys/month, unlimited bandwidth, global CDN
R2 (media storage) Free 10 GB storage + 10M reads/mo free. Then $0.015/GB
DNS Free Unlimited queries, always
SSL Certificates Free Auto-provisioned, auto-renewed, always strict
DDoS Protection Free Enterprise-grade, unmetered, on by default
Domain Registration ~$10/yr At-cost pricing — CF charges what the registry charges
Cost per client site
~$10 / year
07 — Getting Started

Three steps and you're live

Everything else is already built and tested.

Create a Cloudflare account

Free. Takes two minutes at dash.cloudflare.com. Add a payment method for domain registration.

Generate an API token

In CF dashboard → My Profile → API Tokens → Create Token. Permissions needed: Zone, DNS, Pages, R2, Registrar.

Run one command

Paste your token and account ID into th-infra. That's it — every command works immediately.

Ready to try it?

The toolkit is built, tested, and waiting. Set up a CF account and we'll launch a client site together in your next session.

And here's the proof — talkingheads.com is already running on it:

See the Live Site Create Cloudflare Account