Full Report
A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools. The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery. Some bugs were new. Others were already being used before defenders had time to patch. Here is the full
Analysis Summary
# Vulnerability: wp2shell WordPress Core RCE Chained Attack
## CVE Details
- **CVE ID**: CVE-2026-63030 chained with CVE-2026-60137
- **CVSS Score**: Not explicitly listed, but impact is Critical (Remote Code Execution)
- **CWE**: REST API Batch-Route Confusion and SQL Injection
## Affected Systems
- **Products**: WordPress Core
- **Versions**: Standard installations (versions prior to the July 2026 security release)
- **Configurations**: Default installations; does not require specific plugins or themes.
## Vulnerability Description
The vulnerability, dubbed "wp2shell," is a pre-authenticated chain of two flaws. **CVE-2026-63030** involves a logic confusion in how the WordPress REST API handles batch routes, allowing an attacker to bypass certain authentication checks. This is combined with **CVE-2026-60137**, a SQL injection vulnerability within the WordPress core. By chaining these, an anonymous attacker can execute arbitrary code on the underlying server.
## Exploitation
- **Status**: Exploited in the wild / PoC available (confirmed by watchTowr).
- **Complexity**: Low (can be automated via AI-assisted tooling).
- **Attack Vector**: Network (Unauthenticated/Pre-authenticated).
## Impact
- **Confidentiality**: High (Full database access and system file access).
- **Integrity**: High (Ability to modify site content and drop backdoors).
- **Availability**: High (Potential for complete system takeover or site deletion).
## Remediation
### Patches
- Users must update to the latest version of WordPress Core immediately via the dashboard or manual update.
### Workarounds
- Ensure web application firewalls (WAFs) are updated to block suspicious REST API batch requests.
- Implement strict file integrity monitoring to detect post-exploitation backdoors.
## Detection
- **Indicators of Compromise**: Monitor logs for unauthorized or unusual requests to `/wp-json/batch/v1`.
- **Detection methods**: Audit database for unusual user accounts or modified core files.
---
# Vulnerability: SonicWall SMA 1000 Series Critical Command Execution
## CVE Details
- **CVE ID**: CVE-2026-15409 and CVE-2026-15410
- **CVSS Score**: 10.0 (Critical) and 7.2 (High)
- **CWE**: Improper Input Validation / OS Command Injection
## Affected Systems
- **Products**: SonicWall Secure Mobile Access (SMA) 1000 Series VPN appliances.
- **Versions**: Specific firmware versions prior to July 2026.
## Vulnerability Description
These vulnerabilities allow for arbitrary command execution on the appliance. CVE-2026-15409 is a critical flaw that allows an attacker to take over the device completely without authentication.
## Exploitation
- **Status**: Exploited in the wild as Zero-Days (Attributed to actor UTA0533).
- **Complexity**: Low.
- **Attack Vector**: Network.
## Remediation
### Patches
- Apply firmware patches released by SonicWall in mid-July 2026.
## References
- hxxps[://]thehackernews[.]com/2026/07/sonicwall-sma-zero-days-exploited.html
---
# Vulnerability: OpenSSL "HollowByte" Denial of Service
## CVE Details
- **CVE ID**: Not explicitly numbered in text (referred to as "HollowByte")
- **CVSS Score**: Not listed (Severity: High/DoS)
- **CWE**: Improper Resource Allocation (CWE-400)
## Affected Systems
- **Products**: OpenSSL Library
- **Versions**: 3.x and 4.x branches.
## Vulnerability Description
A remote unauthenticated attacker can send a malicious 11-byte payload that tricks OpenSSL into allocating up to 128 KB of heap memory for a handshake that never completes. By repeating this process, an attacker can exhaust system RAM.
## Remediation
### Patches
- **Update to**: OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, or 3.0.21.
## References
- hxxps[://]thehackernews[.]com/2026/07/openssl-hollowbyte-flaw-could-freeze.html