New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
2026-07-18T07:24:09Z•b5882e175ab33def93c385bc5958465d779379cd400207b711c8783e5c00e4e5
ai-servicesbotnetcisa-kevclickfix','acr-stealer','telepuz','clicklock','daxin','stupig','cloud-credentialscode-signingcontagious-interviewdigicertgoldeneyedoghollowbytejwtkubernetesn8nnadmeshnpmopensslratsharepointsteganographysupply-chainsvgvitewordpresswp2shellzoom
What happened
Multiple high-impact incidents and active threats reported: a new WordPress "wp2shell" core vulnerability allows unauthenticated code execution on default installs (two CVEs assigned but not listed here); OpenSSL "HollowByte" can exhaust server memory with 11-byte TLS requests (no CVE published); a cluster of malicious Vite npm packages (ViteVenom/ChainVeil) deliver a RAT via a blockchain-based C2; NadMesh botnet is harvesting exposed AI services to steal cloud keys and Kubernetes tokens; a GoldenEyeDog subgroup is linked to the DigiCert incident and theft of code‑signing certificates. Other重要
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- b5882e175ab33def93c385bc5958465d779379cd400207b711c8783e5c00e4e5
- Enrichment time
- 2026-07-18T07:24:09Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.