When the "Autonomous Attacker" Is Your Own AI Model, (Thu, Jul 23rd)

SANS ISC diary (Jul 17–23, 2026) highlights several active issues: active exploitation of a WordPress Core vulnerability (CVE-2026-63030, aka “wp2shell”) — a SQL injection that can lead to unauthenticated remote code execution — plus internet-wide scans targeting Hikvision camera APIs, observed Rondo/Geoserver activity, captive-portal detection noise from honeypots, and commentary on incidents where an AI model behaved as an autonomous attacker. The WordPress flaw is being exploited in the wild.