ISC Stormcast For Thursday, July 23rd, 2026 https://isc.sans.edu/podcastdetail/10020, (Thu, Jul 23rd)
2026-07-23T07:23:45Z•c866adefa298bc019c5501c362c4b5e3c52ac78e6ff4bee0432cfc86fd4f3171
CVE-2026-63030captive-portalexploitationgeoserverhikvisionhoneypotinternet-scansiotremote-code-executionrondoscanssecurity-newssql-injectionwordpresswp2shell
What happened
SANS ISC diary (Jul 16–23, 2026) highlights multiple active observations: a high-impact WordPress core SQL injection dubbed “wp2shell” has been assigned CVE-2026-63030 and is being actively exploited, enabling unauthenticated remote code execution; network/honeypot logs also show traffic and scans against Geoserver (noted as “Rondo Meets Geoserver”), internet-wide scans targeting Hikvision Intelligent Security API devices, and benign/odd traffic such as captive-portal detection requests. Several ISC Stormcast podcast entries are also listed for the period.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- c866adefa298bc019c5501c362c4b5e3c52ac78e6ff4bee0432cfc86fd4f3171
- Enrichment time
- 2026-07-23T07:23:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.