The Carousel That Remembered Him

The first customer disappeared from the website at 2:13 a.m.

Miriam knew because the website told her.

A white box sat on the homepage where the summer sale banner should have been.

ONE VISITOR HAS FAILED TO PROVE THEY ARE HUMAN

Beneath it, a spinning wheel turned, bright and delicate, like a toy carousel.

Miriam sat in bed, blue light on her face, and waited for the wheel to stop.

It kept turning.

At 2:18 a.m., she messaged Elias.

Are you awake?

I am now.

The website says someone failed to prove they are human.

Screenshot?

She sent it.

Three dots appeared. Vanished. Appeared again.

Who touched the site today?

You added the cookie plugin last week. Arun added the SEO plugin Monday. Lorris did updates before that.

I'll check.

The carousel's horses were hard to see, but each time one turned past the front, she thought she glimpsed a rider.

Please don't give me "we need to investigate," she typed. I need something solid.

Solid takes evidence.

Then find evidence.

For several minutes, the house became aware of her. The ceiling fan clicked. Rain touched the windows. The wardrobe stood open by two inches, as though listening.

Daniel would have known where to start.

The thought arrived uninvited. Most thoughts of Daniel did. They arrived without asking whether the room had space.

He had been dead seven months, long enough for official documents to stop arriving, too short for his coffee mug to become an ordinary object. He had handled the website before the illness became visible. He distrusted agencies and retainers. He distrusted any plugin that called itself "essential," though he had installed several.

The homepage loaded halfway. Lantern & Co. appeared in its familiar gold letters, then flickered.

CLICK TO PROVE YOU ARE HUMAN

The button pulsed faintly.

Miriam did not click it.

At 2:41 a.m., Elias sent a note.

The prompt shows only on some visits. Incognito triggers it more often. Admins don't see it. Likely conditional injection.

Cookie plugin: six days ago. SEO plugin: four days ago. Shield plugin went in after the prompt was reported, malware detected after that.

Detection after installation doesn't prove origin after installation.

She read the last line twice. Elias wrote careful sentences the way some men locked doors.

At 4:08 a.m.:

Found something. A suspicious file, created last August.

August?

Before you. Before the SEO work too.

The carousel turned once. Twice. The riders came into view, and she saw their faces. Blank and smooth. Almost human.

So it slept, she typed.

That's one way to put it.

August had been Daniel's month of sudden energy. Before it, he moved through the house as though walking underwater. Then, for two weeks, he became almost himself. He repainted the counter. He bought a secondhand label printer. He decided the homepage looked too cold.

"It must feel alive," he had told her at the dining table, laptop open.

"It sells paper," Miriam had said.

"Paper is alive if you use it properly."

He smiled, proud of himself, and she let him have it.

At 7:26 a.m., Max emailed everyone:

---

Morning all,

This is concerning. The question is simple: what changed recently?

We engaged Elias and Arun for SEO work. In the same period, the site began showing malicious prompts. I understand there may be wider WordPress attacks, but we need to avoid vague explanations.

Please confirm which plugins were installed, whether the SEO work touched site files, whether the malware came through those changes, and what is being done now.

I need a clear answer today.

Max

---

Miriam read it barefoot in the kitchen. Morning light lay across the tiles in a dull sheet. The kettle clicked off. From the living room, Daniel's old clock chimed eight times, paused, then chimed a ninth.

It had been doing that since the funeral.

At 8:02 a.m., Elias wrote again.

The SEO plugins are recent. The malicious file is older. Max will hear: after your work, we saw malware. The truth will sound like evasion unless it's arranged properly.

Miriam almost laughed. Truth always sounded like evasion when it arrived late.

She searched her inbox for August. The first result appeared at once.

---

From: Daniel Voss

Subject: Carousel plugin for homepage

Date: 19 August, 10:39 p.m.

---

Her hand moved off the mouse.

The kitchen changed. Only slightly. The refrigerator's hum lowered into something like a note. The tile underfoot turned colder. In the window above the sink, her reflection stood behind her reflection, one leaning close to the glass, the other still.

She opened it.

---

Miri,

Bought the carousel plugin you liked. The homepage looks warmer now. You were right about the old version feeling too cold.

I know you think I'm too stubborn about the website. You're probably right. I keep wanting to fix things before you see them. Bad habit.

If this breaks anything, I'll take the blame.

D.

---

The clock chimed once.

On her laptop, the homepage refreshed by itself. The carousel had grown. The blank riders were gone. In their place stood small wooden horses, old-fashioned and beautifully painted, each carrying something from the shop: a fountain pen, a ledger, a brass key, a roll of brown wrapping paper.

Then a horse carrying Daniel's blue mug.

Miriam shut the laptop.

At 9:07 a.m., she messaged Elias.

I found the receipt. Daniel bought the plugin.

Are you sure?

He emailed me the invoice.

Send it if you want me to confirm.

She looked at the invoice. Daniel's name, the date, the charge. Then she closed it.

I'm not sending it, she typed. Max will see the date and stop seeing the man.

Daniel bought a plugin, Elias wrote. He did not plant malware.

That distinction won't survive the room.

Then we make the room behave.

He sent his email to Max at 11:14:

---

Hi Max,

The strongest finding is the timing. The backdoor file appears in the logs in August, months before the SEO work. The infection was detected this week, after the shield plugin was added to look for it.

The only plugins installed for the SEO work were the cookie plugin and the SEO plugin. The logs don't point to either as the source.

This looks more like a dormant compromise through an older plugin that woke up later. A proper security review will confirm it.

Let's have a call today to align on next steps.

Best, Elias

---

Miriam noticed what he had left out.

Daniel.

The call was at noon. Max asked whether the SEO work caused the malware. Elias answered with dates. Lorris confirmed he'd seen odd footer output before the shield went in. Arun confirmed he had installed the SEO plugin and the shield.

Then Max asked who installed the older plugin.

The silence had furniture in it. A hospital chair. A paper cup of water. Daniel's hand, lighter than it should have been, on a blanket.

"Daniel did," Miriam said.

No one spoke for four seconds.

"Daniel is gone. The site is still here. Tell me what we do next."

After the call, everyone was gentler with her. It annoyed her. Gentleness, badly timed, could feel like being moved from a chair to a shelf.

At 4:40 p.m., Elias wrote again.

The logs argue our case. They don't close it. What would close it is a clean copy of the site from before August, dated and untouched, from somewhere the infection never reached. Then the review is one sentence long. I don't suppose Daniel kept that kind of thing.

At 5:12 p.m., a second email from Daniel surfaced.

It made no sound. It rose to the top of her inbox as if it had been waiting below the surface.

---

From: Daniel Voss

Subject: If the homepage ever breaks

Date: 03 October, 9:00 a.m.

---

Daniel had died on 28 September.

Miriam did not open it at once. The house noticed. The clock stopped. The ceiling fan slowed. In the hallway, a framed photograph of the two of them tilted forward by a fraction, listening.

She opened it.

---

Miri,

I scheduled this because I know myself. If I send it now, I'll hover, waiting for praise. If it comes later, maybe it's useful instead of needy.

The backups are in the folder marked Lantern Old, the whole site as it was before I started meddling with it. The password is the song you said was playing when I first asked you to dinner. All lowercase, no spaces. You said nobody remembers a song that badly. I did.

If anything breaks, give the backups to someone patient. Someone who doesn't rush to sound clever.

And if one of my clever fixes turns out to be the thing that broke it, don't defend me too much. I liked being right. I loved you more.

D.

---

The kitchen returned to itself. The refrigerator hummed in its ordinary register. The clock resumed on the wrong second. Outside, a motorbike passed too loudly.

Miriam sat down.

She did not remember the song.

She remembered the restaurant. A blue tablecloth. Daniel ordering fish and pretending to like it until she took one bite and told him, mercifully, that it tasted like wet cardboard. She remembered him laughing so hard he had to take off his glasses.

The song had gone. It felt like a second death, smaller and meaner than the first.

At 5:33 p.m.:

I forgot the song.

Check old photos, captions, receipts, messages, Elias replied.

We were old before we learned to save everything.

Then check what you didn't think was worth saving.

Annoying advice, because it was good.

She went through drawers. Expired warranties, folded receipts, a cracked phone case, a birthday card from a Louise she could no longer place, a packet of seeds for a balcony garden they never planted.

At the bottom of a biscuit tin, under paper clips and foreign coins, she found a receipt from a restaurant that had closed years ago. The ink had almost faded. At the bottom, in Daniel's handwriting, two words.

Moon River.

Of course.

The password worked.

Inside Lantern Old was the website as it had been before the carousel and the moving banners, before Daniel tried to make everything feel alive. The old homepage loaded slowly.

Lantern & Co. Books, stationery, and small useful things. Founded by Miriam and Daniel Voss.

Below the text, a photograph.

Miriam stopped breathing for a moment.

Daniel stood behind the first counter, one hand raised against the camera, caught between protest and laughter. She had hunted for this photograph after the funeral. She had accused her own memory of inventing it, because no one else remembered it being taken.

There it was. Badly lit and slightly blurred. Perfect.

And it was the copy Elias needed. Clean, from before any of it: Daniel's whole site as it stood the day before he started meddling. The one sentence that would end the review and take his name out of Max's mouth for good.

She reached to copy the folder.

Then the screen dimmed, and the carousel returned.

It had followed her in. The horses waited in a circle at the edge of the old homepage, and on each saddle sat something the website had taken: an abandoned basket, a newsletter signup, a product image, a line of code, Daniel's mug, Miriam's song. The clean archive was clean no longer. The thing had found the one folder she would open without thinking, and made itself at home in it.

At the centre was the white box.

CLICK TO RESTORE THE SITE

She messaged Elias, fast.

It's in Lantern Old. The whole backup. The prompt's sitting on top of it.

Then the backup's reached, he wrote. Don't touch the prompt. That isn't a button, it's the trigger. Click it and the payload runs. It encrypts the archive and everything inside.

Can you clean it?

Not in time, not from here. The safe move is to wipe the whole archive and rebuild the live site from scratch.

She understood before she finished reading. Wipe the archive, and the clean dated copy went with it. The proof.

That's the evidence, she typed.

That's the evidence, he agreed. Your call.

The box flickered, as though it had read the thread.

CLICK TO RESTORE HIM

"No," she said.

The horses creaked.

CLICK TO KEEP HIM

Her hand tightened on the mouse.

That was the thing about malicious promises. They understood the shape of wanting. They never had to create hunger. They only had to find where it already lived. It was not offering her a backup. It was offering her Daniel, and it knew that mattered to her more than the review, more than being proven right about the man.

And it was lying. Clicking kept nothing. The payload would take the archive and the photograph with it and grind both into noise.

She could save the picture. One file, dragged clear before the rest was wiped. Not the backup. Not the sentence that would clear his name. One blurred image of a man with his hand up, halfway to a laugh.

Miriam closed her eyes. She saw him at the restaurant, grimacing through the fish. The counter, failing to dodge the camera. The dining table, insisting the homepage needed movement. Then the hospital bed.

Don't defend me too much, he had written. I liked being right. I loved you more.

She opened her eyes.

She dragged counter_opening_day.jpg out of Lantern Old and onto a clean drive. One file. It copied in a second.

Then she texted Elias a single word.

Wipe it.

You're sure? The review...

Let Max have the logs and your word. Wipe it.

The carousel began to turn. Slowly, then faster. The horses blurred. The white prompt widened, its edges trembling like paper held above a flame.

PROVE YOU ARE HUMAN, it demanded.

Miriam unplugged the router.

The house went still. No clock. No voice from the place where old code and grief had learned to imitate each other.

Only rain, returning.

The next morning, Elias removed the infected plugin and the backdoor file, then closed the two unused admin accounts. He wiped what was left of Lantern Old, which held nothing worth trusting now, and set a clean backup running from that day on.

The review stayed open a while. In the end Max took the logs and Elias's word, the way you take a thing you cannot quite prove. Daniel's name stayed in the record, never cleared, never quite condemned. Miriam found she could live with it.

She printed the photograph on matte paper and put it in the shop drawer, beneath the spare keys.

On the live site, the homepage moved beautifully again. Products loaded. Customers clicked. No one visiting Lantern & Co. would know that a dead man had left behind the proof of his own innocence, and that his wife had let it burn to keep a single blurred photograph.

Before closing that evening, she opened the drawer once more.

Daniel raised his hand against the camera, still refusing the picture, still failing.

Outside, rain tapped softly on the glass.

The website had stopped asking people to prove they were human.