ISC Stormcast For Thursday, July 23rd, 2026 https://isc.sans.edu/podcastdetail/10020, (Thu, Jul 23rd)
2026-07-23T13:23:45Z•919177399eea4ce3104d254eb2850c534fbfb6c5523286a99b6b0835e13e605b
CVE-2026-63030captive-portal-detectionexploitationgeoserverhikvisionhoneypot-telemetryiot-scanningremote-code-executionsql-injectionwordpresswp2shell
What happened
The ISC SANS diary feed (July 16–23, 2026) highlights an active exploitation of a WordPress Core SQL injection (wp2shell) that has been assigned CVE-2026-63030 and can lead to unauthenticated remote code execution. Additional telemetry from their honeypots shows internet-wide scans targeting Hikvision devices (Intelligent Security API) and some suspicious activity involving Geoserver (“Rondo” logs). The feed also notes non-malicious detections such as browser captive-portal checks. Immediate attention should be given to patching/updating WordPress instances to address CVE-2026-63030.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 919177399eea4ce3104d254eb2850c534fbfb6c5523286a99b6b0835e13e605b
- Enrichment time
- 2026-07-23T13:23:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.