New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

This collection highlights multiple high-impact vulnerabilities, active malware campaigns, and supply-chain attacks. Key issues: a WordPress core unauthenticated RCE dubbed “wp2shell” (affecting 6.9/7.0 until forced updates landed); OpenSSL “HollowByte” denial-of-service via an 11‑byte TLS request (no CVE published); a Vite/npm supply‑chain campaign (ViteVenom/ChainVeil) delivering a RAT via blockchain-based C2; NadMesh Go botnet scanning exposed AI services to harvest cloud keys and Kubernetes tokens; DigiCert code‑signing certificate theft tied to a GoldenEyeDog subgroup; and resurfacing ofь