Loading story…
A suspected Chinese-speaking threat actor tracked by GreyNoise as Kapibala, and assessed as the same as or related to Red Heron, exploited the wp2shell WordPress chain—CVE-2026-63030 and SQL-injection flaw CVE-2026-60137—to compromise at least 49 organizations across 29 countries. The campaign deployed custom webshells, created hidden WordPress administrator accounts, stole database configuration and credential data, and used password spraying to access internal SQL services. A Western government organization lost at least 18,566 records containing account data, plaintext passwords, and personally identifiable information.
The actor also exploited CVE-2026-7273 in ZyXEL GS1900 switches, targeting 996 devices in 48 countries and collecting configurations, hashed root credentials, and network data, while scanning other exposed products including Ubiquiti UniFi OS, Gitea, Proxmox VE, FlowiseAI, and Nuclio. WordPress has patched CVE-2026-60137 in versions 6.8.6, 6.9.5, and 7.0.2; affected organizations should update immediately, rotate potentially exposed credentials, remove unauthorized administrator accounts, investigate for webshells, restrict database access, and monitor for password spraying and bulk archive downloads.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
On or about this date, the actor began exploiting CVE-2026-7273 in ZyXEL GS1900 Smart Managed Switches. The activity compromised 996 devices in 48 countries and exfiltrated device configurations, hashed root credentials, and network information; 564 affected devices used factory-default credentials.
The actor exploited a western government organization's WordPress site, deployed a custom webshell, and stole 13 administrator accounts. It then obtained backend SQL credentials, accessed an internal SQL database through password spraying, and exfiltrated at least 18,566 records containing accounts, plaintext passwords, and PII associated with law-enforcement and government agencies.
Around 20 July 2026, the actor began exploiting the wp2shell chain, involving CVE-2026-63030 and CVE-2026-60137. The campaign ultimately compromised at least 49 organizations in 29 countries, primarily affecting small-business and government targets.
CISA added CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 to its Known Exploited Vulnerabilities catalog after exploitation activity involving the UniFi OS flaw chain.
The actor attempted to chain CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 for remote code execution against unpatched Ubiquiti UniFi OS devices, attempting to download and execute a backdoor from staging infrastructure.
GreyNoise assessed activity attributable to a suspected Chinese-speaking actor, potentially related to Red Heron, from 7 May 2026 onward. The actor subsequently targeted or exploited products including PAN-OS GlobalProtect, UniFi OS, Gitea, WordPress, and other internet-facing systems.
WordPress addressed CVE-2026-60137, an SQL injection vulnerability affecting several WordPress release branches. Fixed versions are 6.8.6, 6.9.5, and 7.0.2 for their respective affected branches.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceboho.or.kr
Open sourcegreynoise.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An exposed server tied to the **WP-SHELLSTORM** cybercrime operation revealed tooling, logs, command history, and target lists for a large-scale webshell campaign aimed primarily at **WordPress** sites, with additional targeting of **Joomla** and enterprise Java platforms. Researchers said the group scanned more than **1.4 million domains**, exploited **27 CVEs**—including the Breeze plugin flaw `CVE-2026-3844`—and maintained roughly **5,700 active webshells**, while some analysis put validated compromises as high as **25,195**. The operation used layered implants including BestShell-derived webshells, a **SNOWLIGHT** dropper, and a **VShell** payload disguised as a Linux `kworker` process, then resold access to compromised websites. The exposed infrastructure also linked the operators to a separate campaign against **Nacos** deployments, where they exploited the authentication bypass `CVE-2021-29441` and stole **613 configuration files** from **11 systems** across **nine organizations**. Investigators assessed the activity with medium-to-high confidence as **financially motivated** and likely conducted by **Chinese or Chinese-speaking** operators rather than a state-backed APT, citing Simplified Chinese artifacts, FOFA usage, and overlap between the web and Java intrusion sets. The operators reportedly tried to alter access logs after the server was discovered, but the exposure had already disclosed extensive indicators of compromise and operational details.
Jul 23, 2026
WordPress released **7.0.2** to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including **CVE-2026-63030** and **CVE-2026-60137**. The flaws affect default WordPress installations without plugins, with the RCE path impacting **6.9.0 through 6.9.4**, **7.0.0 through 7.0.1**, and **7.1 beta**, while the SQL injection issue also affects the **6.8** branch. WordPress issued backported fixes in **6.9.5**, **6.8.6**, and **7.1 Beta 2**, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise. Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.
Aug 26, 2026
WordPress released security updates for two core vulnerabilities, **CVE-2026-63030** and **CVE-2026-60137**, that can be chained to make a blind SQL injection remotely reachable without authentication and, in some cases, lead to **remote code execution**. The issue, dubbed **`wp2shell`**, stems from REST API batch-route confusion in the `/wp-json/batch/v1` endpoint combined with SQL injection, affecting WordPress versions **6.9.0 through 6.9.4** and **7.0.0 through 7.0.1**. Researchers said the route-confusion flaw carries a **CVSS 9.8** rating, while the second SQL injection bug is rated **CVSS 5.9**. WordPress fixed the flaws in **6.9.5** and **7.0.2**, and also backported the SQL injection fix to **6.8.6**. The vulnerabilities were reported by Adam Kues of Assetnote through the WordPress HackerOne program, and while exploitation had not been confirmed at the time of disclosure, a public proof of concept later became available, increasing the risk of rapid weaponization. Administrators were urged to verify that forced automatic updates succeeded and, if immediate patching was not possible, to apply mitigations such as blocking the REST batch endpoint with a WAF.
Jul 31, 2026