ISC Stormcast For Wednesday, July 22nd, 2026 https://isc.sans.edu/podcastdetail/10018, (Wed, Jul 22nd)

SANS ISC diary roundup (Jul 14–22, 2026): Active exploitation observed for a newly assigned WordPress Core vulnerability (wp2shell, CVE-2026-63030) — an SQL injection in core that can lead to unauthenticated remote code execution. ISC notes exploitation activity following disclosure. Other items: internet-wide scans targeting Hikvision Intelligent Security API and continued targeting of IoT/camera devices; benign-looking captive portal detection traffic seen by honeypots; and a DShield SIEM update (ELK 8.19.15) with added dashboards/logs. Multiple Stormcast podcast entries also published.