Security News

Critical wp2shell Vulnerability Hits WordPress Core, Patch Released

WordPress has released security updates to address the wp2shell vulnerability, a critical flaw that allowed attackers to achieve remote code execution (RCE) on vulnerable sites using a single anonymous web request. Unlike many previous attacks, this issue did not require plugins, authentication, or third-party code, making affected core installations particularly vulnerable. Security patches were released in WordPress 6.9.5 and 7.0.2. wp2shell Vulnerability Exposed Core WordPress Sites Tracked as CVE-2026-63030, the wp2shell vulnerability is described in the official WordPress release notes as

Related Companies

W

wordpress

W

webpros

C

cpanel

C

cheshire-cat-ai

A

automattic

K

Kiteworks

L

limanmys

D

drupal

'Klein deel van door AI gevonden beveiligingslekken misbruikt bij aanvallen'

Een klein deel van de kwetsbaarheden die dit jaar door AI zijn gevonden, zijn misbruikt bij aanvallen, zo stelt ...

Student Hacks IIT Kanpur Website After Rejection, Gets Technical Assessment

The IIT Kanpur Website Hack has taken an unexpected turn after the institute decided to assess the technical skills of a student who allegedly breached parts of the IIT Kanpur and IIT Madras websites following his rejection from the newly launched undergraduate cybersecurity program. Instead of immediately pursuing legal action, IIT Kanpur said it would conduct a formal technical evaluation, though admission for the current academic session remains closed. The incident of IIT Kanpur website hack came to light after the student shared posts on X and Reddit, claiming he had breached sections of

Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation

The Russian threat actors recently linked to the exploitation of a now-patched vulnerability in Zimbra have been observed exploiting another vulnerability, this time in Microsoft Outlook Web Access (OWA), to target U.S. and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors. The activity, which began on July 22, 2026, involves the

Related Companies

M

microsoft

S

synacor

K

keephq

FCC Blocks New Foreign-Produced Robots and Power Inverters Over Cyber Risks

The Federal Communications Commission (FCC) added foreign-produced mobile robots and networked power inverters to its Covered List on July 28. The move generally prevents new models from receiving the equipment authorization required for import, marketing, or sale in the US. Previously authorized models can still be sold, and devices people already own are unaffected. Federal purchases and use

Related Companies

M

microsoft

U

unitree

Cisco meldt misbruik van hardcoded wachtwoord in firewall-beheersoftware

Aanvallers maken actief misbruik van een hardcoded wachtwoord in het Cisco Secure Firewall Management Center (FMC), software ...

Related Companies

C

cisco

S

Sophos

Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet

Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than 2 billion weekly downloads between them. The original Aikido and Wiz reports did not attribute the

Related Companies

N

npm

C

chalk

D

debug-js

A

amazon

Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a newly disclosed security flaw impacting Cisco Secure Firewall Management Center (FMC) Software to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation. The vulnerability, assigned CVE-2026-20316 (CVSS score: 5.3), could permit an unauthenticated, remote attacker to log

Related Companies

C

cisco

Falcon AIDR Now Protects Copilot Studio Agents and Claude Code

Related Companies

M

microsoft

O

outerbase

A

anthropic

ISC Stormcast For Thursday, July 30th, 2026 https://isc.sans.edu/podcastdetail/10030, (Thu, Jul 30th)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Related Companies

I

isc