ISC Stormcast For Friday, July 24th, 2026 https://isc.sans.edu/podcastdetail/10022, (Fri, Jul 24th)

SANS ISC diary highlights multiple security developments (Jul 19–24, 2026). Most notable: active exploitation of a WordPress Core SQL injection dubbed “wp2shell”, now tracked as CVE-2026-63030, which can lead to unauthenticated remote code execution and is being weaponized in the wild. Other entries cover opportunistic internet-wide scans targeting Hikvision camera Intelligent Security APIs, detections from honeypots (including captive-portal-related traffic), an observed interaction between Rondo activity and GeoServer instances, and a discussion of intrusions where an attacker’s own AI model