ISC Stormcast For Friday, July 24th, 2026 https://isc.sans.edu/podcastdetail/10022, (Fri, Jul 24th)

SANS ISC diary entries (Jul 19–24, 2026) report multiple observations: active exploitation of a WordPress Core SQL injection vulnerability dubbed “wp2shell” (CVE-2026-63030) enabling unauthenticated remote code execution and observed in the wild; Internet-wide scans targeting Hikvision Intelligent Security API devices; Geoserver activity tied to Rondo-related traffic; a note on benign captive-portal detection traffic from honeypots; and discussion of intrusions involving AI models acting as autonomous attackers. Operators should prioritize patching/updating WordPress installations, monitor for