SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 106

Security Affairs roundup covering multiple high-impact security events: public exploits for two critical WordPress wp2shell vulnerabilities (CVE-2026-63030, CVE-2026-60137) enabling pre-auth remote code execution; OpenSSL ‘HollowByte’ 11-byte memory-exhaustion/DoS disclosed by Okta; long-running China-linked Daxin kernel rootkit and new Stupig backdoor found active on a manufacturer’s network; CISA additions to its Known Exploited Vulnerabilities (including Fortinet FortiSandbox and Microsoft SharePoint issues) and further KEV additions for KNX/Oracle; a third‑party support-ticket-linked data‑