Rondo Meets Geoserver, (Wed, Jul 22nd)

SANS ISC diary entries (Jul 15–22, 2026) note active exploitation activity and opportunistic scanning observed by their honeypots. The key issue is active exploitation of a WordPress Core SQL injection vulnerability ("wp2shell") that has been assigned CVE-2026-63030 and can lead to unauthenticated remote code execution. Other observations include internet-wide scans targeting Hikvision Intelligent Security API (camera/IoT devices), a honeypot event showing Rondo interacting with GeoServer, and non-malicious but notable captive-portal detection traffic.