A hacked WordPress, two attackers, and the hole no antivirus saw

Blank page for humans, spam for Googlebot, and an antivirus silent on 373 files. Tracing the entry point through eighteen seconds of logs, then making the intrusion impossible to replay.