ISC Stormcast For Wednesday, July 22nd, 2026 https://isc.sans.edu/podcastdetail/10018, (Wed, Jul 22nd)

2026-07-22T07:23:46Z•f39119fc821eee74fdc70564c9791f6028415ad630fea3d43c3d19b4b947f741

CVE-2026-63030ELKcaptive-portaldshieldexploitationhikvisionhoneypotiot-camerasremote-code-executionscanningsiemsql-injectionwordpresswp2shell

Open source link →

What happened

ISC SANS diary highlights active exploitation of a recently named WordPress Core vulnerability ("wp2shell") — CVE-2026-63030 — a SQL injection in core that can lead to unauthenticated remote code execution. The feed also notes widespread scanning activity (including scans targeting Hikvision Intelligent Security API), benign/odd traffic such as captive-portal detection hits seen by honeypots, and an update to the DShield SIEM (ELK 8.19.15) with new dashboards/logs.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: sans_isc_diary
Record identifier: f39119fc821eee74fdc70564c9791f6028415ad630fea3d43c3d19b4b947f741
Enrichment time: 2026-07-22T07:23:46Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records