Hackers are actively exploiting critical vulnerabilities in WordPress Core to deploy persistent webshells and malicious plugins. The wp2shell vulnerability suite affects multiple WordPress installations globally.
The wp2shell exploit chain, comprising CVE-2026-63030 and CVE-2026-60137, represents a significant threat to WordPress deployments. Attackers are leveraging these critical flaws to gain unauthorized access and establish persistent backdoors on compromised servers.
Attack Vector
The vulnerabilities allow threat actors to install webshells—malicious scripts that provide remote access—directly onto affected WordPress installations. Once deployed, these webshells enable attackers to execute arbitrary commands and maintain long-term control over compromised systems.
Impact
Compromised websites face multiple risks:
- Unauthorized data access and exfiltration
- Installation of malicious plugins for sustained persistence
- Potential malware distribution to site visitors
- Server resource hijacking for cryptomining or botnet operations
Current Status
Active exploitation has been confirmed in the wild. The vulnerability affects WordPress Core, meaning any unpatched installation running vulnerable versions is at immediate risk. Security researchers report widespread scanning activity as attackers identify and target exposed instances.
Recommendations
WordPress administrators should take immediate action:
- Update WordPress Core to the latest patched version
- Audit active plugins and remove any suspicious entries
- Review user accounts for unauthorized access
- Check server logs for suspicious webshell uploads
- Implement Web Application Firewall (WAF) rules
- Enable two-factor authentication for admin accounts
Organizations running WordPress at scale should prioritize patching across all instances and conduct comprehensive security reviews of affected systems. The critical severity rating warrants emergency response procedures.
The wp2shell vulnerability demonstrates the ongoing risk WordPress deployments face without regular security updates and monitoring.
Apple defeated liability claims for not scanning iCloud photos for child sexual abuse material (CSAM), though the presiding judge expressed clear disapproval of the company's position.
A massive operation called FakeGit has weaponized over 7,600 GitHub repositories to distribute SmartLoader and StealC malware, accumulating more than 14 million downloads across the platform.
Cisco released two open-weight AI models, Antares-350M and Antares-1B, designed to identify known vulnerabilities in codebases. The company plans to release a larger Antares-3B model soon.
Attackers are actively exploiting CVE-2026-50522, a critical remote code execution vulnerability in Microsoft SharePoint, to extract machine keys that persist even after patches are applied. The flaw enables long-term access to compromised systems.