ISC Stormcast For Friday, July 24th, 2026 https://isc.sans.edu/podcastdetail/10022, (Fri, Jul 24th)
2026-07-26T13:23:43Z•95f3bbacfd88012449ddad5632633c3c77c8b877f8780c5d73e2e61439db6f3d
CVE-2026-63030ai-attackercaptive-portalexploitationgeoserverhikvisionhoneypotiot-cameraisc-sanspodcastremote-code-executionrondoscanssql-injectionwordpresswp2shell
What happened
Collection of ISC SANS Diary items (Jul 19–24, 2026) covering multiple operational security topics. Notable: active exploitation of a WordPress Core SQL injection dubbed “wp2shell” now assigned CVE-2026-63030 and observed in the wild (unauthenticated RCE risk); internet-wide scans targeting Hikvision camera APIs; an observed Rondo/GeoServer interaction in honepot logs; discussion of AI-as-attacker and captive-portal detection; plus regular Stormcast podcast entries.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 95f3bbacfd88012449ddad5632633c3c77c8b877f8780c5d73e2e61439db6f3d
- Enrichment time
- 2026-07-26T13:23:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.