Forgot to Update Livewire. Got Hacked

A developer shares a first-hand account of getting hacked through an outdated Livewire package on a forgotten side project. Automated scanners found the CVE, exploited it, stole the .env file containing Mailcoach API keys, and sent 50,000 spam emails. Docker container isolation limited the blast radius to just that one service. Key lessons include setting up automated dependency update alerts for all projects (including dormant ones), scoping API tokens tightly, and either maintaining or shutting down side projects — because automated bots continuously scan for known vulnerabilities.