Daily Threat Briefing
← All briefings

Comodo Internet Security · WordPress Seotheme · WordPress Background Image Cropper plugin

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-06-08 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

Today’s most significant new development is the public disclosure of CVE-2026-49494, a remotely exploitable kernel-level denial-of-service vulnerability in Comodo Internet Security’s firewall driver, with a public proof-of-concept and exploit code already published. Three critical unauthenticated remote code execution vulnerabilities in legacy WordPress themes and plugins (CVE-2023-54352, CVE-2024-58348, CVE-2024-58349) were formally catalogued today with Exploit-DB entries, raising the risk of opportunistic mass exploitation against unpatched WordPress installations. No new BSI or CERT-EU advisories were published in the reporting period. The Miasma supply chain worm and the Cisco SD-WAN Manager active exploitation situation continue without material new developments since yesterday.

CRITICAL VULNERABILITIES

CVE-2026-49494 (NEW)

  • Affected products: Comodo Internet Security (all versions with Inspect.sys firewall driver; confirmed on versions prior to fix)
  • Severity: High (CVSS 3.1: 7.5; CVSS 4.0: 8.7)
  • Exploitation status: Public proof-of-concept and exploit code published at github.com/MalwareTech/ComoDoS; no confirmed in-the-wild exploitation at time of writing
  • Technical detail: An integer underflow in the IPv6 packet parser within the kernel-mode driver Inspect.sys allows a remote, unauthenticated attacker to send a single crafted IPv6 packet to trigger an out-of-bounds read and oversized memcpy at DISPATCH_LEVEL, crashing the Windows kernel (BSOD). Critically, the vulnerability is triggered before firewall rule enforcement, meaning hosts with all ports blocked remain vulnerable if IPv6 is reachable.
  • Remediation: Check Comodo’s trust center for an updated driver release. As an immediate compensating control, block unsolicited IPv6 traffic at the network perimeter and on host-based firewalls where Comodo Internet Security is deployed. Assess whether Comodo is present in your enterprise endpoint inventory; this product is less common in large enterprises but may appear in SMB environments or on unmanaged endpoints.

CVE-2023-54352 (NEW)

  • Affected products: WordPress Seotheme (all versions)
  • Severity: Critical (CVSS 3.1: 9.8)
  • Exploitation status: Public exploit available on Exploit-DB (EDB-51789); no confirmed mass exploitation confirmed at time of writing, but unauthenticated nature and Exploit-DB listing make opportunistic scanning highly likely
  • Technical detail: Unauthenticated attackers can upload malicious PHP files to the theme directory and execute them via /wp-content/themes/seotheme/mar.php, achieving full remote code execution and persistent access.
  • Remediation: Remove or replace the Seotheme theme immediately. Scan web roots for the presence of mar.php or other unexpected PHP files in theme directories. This theme appears to be abandoned with no vendor patch available.

CVE-2024-58348 (NEW)

  • Affected products: WordPress Background Image Cropper plugin version 1.2
  • Severity: Critical (CVSS 3.1: 9.8)
  • Exploitation status: Public exploit available on Exploit-DB (EDB-51998)
  • Technical detail: The ups.php endpoint accepts unauthenticated file uploads with no type validation, allowing direct upload and execution of arbitrary PHP files.
  • Remediation: Deactivate and remove the plugin immediately. No patched version is available. Audit the plugin directory for unexpected PHP files.

CVE-2024-58349 (NEW)

  • Affected products: WordPress Theme Travelscape version 1.0.3
  • Severity: Critical (CVSS 3.1: 9.8)
  • Exploitation status: Public exploit available on Exploit-DB (EDB-51969)
  • Technical detail: Insufficient upload validation in the theme’s upload functionality allows unauthenticated attackers to upload and execute arbitrary files, achieving remote code execution.
  • Remediation: Remove the theme immediately. No vendor patch is available. Check theme directories for unexpected executable files.

Note on CVE-2023-54350 (WordPress Augmented-Reality plugin, CVSS 3.1: 7.5, unauthenticated RCE via elFinder connector): Also published today with an Exploit-DB entry. Lower severity than the above three but warrants inclusion in WordPress plugin audits. Remove or replace the plugin if present.

ONGOING

  • CVE-2026-20245 (Cisco Catalyst SD-WAN Manager): Actively exploited, no patch available; restrict management plane access to trusted IPs.
  • CVE-2026-28318 (SolarWinds Serv-U): Actively exploited DoS; apply 15.5.4 Hotfix 1, CISA deadline 2026-06-19.
  • CVE-2026-3300 (Everest Forms Pro WordPress): Actively exploited RCE; update immediately.
  • CVE-2026-11450 (GL.iNet GL-MT3000): Public PoC available; upgrade firmware to 4.7 or later.
  • CVE-2026-20230 (Cisco Unified CM): Public exploit available; patch immediately.
  • CVE-2026-45247 (Mirasvit Full Page Cache Warmer): Actively exploited; patch immediately.
  • CVE-2026-9851 (Booking Package WordPress): Privilege escalation to admin; update immediately.
  • CVE-2026-7537 (MDJM Event Management WordPress): Arbitrary file upload with public PoC; update immediately.

EUROPEAN ADVISORIES

No new BSI CERT-Bund or CERT-EU advisories were published in the last 24 hours.

Previously reported advisories remain active: WID-SEC-2026-1801 (Cisco UCM), WID-SEC-2026-1794 (Chrome/Edge), WID-SEC-2026-1791 (HTTP/2), WID-SEC-2026-1788 (Cisco SD-WAN Manager), WID-SEC-2026-1800 (MISP), and WID-SEC-2026-1804 (BigBlueButton). Remediation guidance is unchanged.

ACTIVE THREATS AND CAMPAIGNS

Miasma Worm - GitHub Supply Chain (ONGOING) 73 Microsoft GitHub repositories across Azure, Azure-Samples, Microsoft, and MicrosoftDocs organizations remain disabled. No new IOCs or scope expansion reported in the last 24 hours. Continue auditing CI/CD pipelines referencing these organizations.

FIFA World Cup 2026 Fraud (ONGOING - ELEVATED URGENCY) The June 11 tournament kickoff is now three days away. Lookalike FIFA domains, banking malware embedded in pirate streaming applications, and credential-harvesting login pages remain active. The window for pre-event phishing and fraud activity is at its peak. Ensure staff awareness communications have been issued and that perimeter controls are blocking known malicious FIFA-themed domains.

OP-512 IIS Web Shell Campaign (ONGOING) China-linked threat cluster continues targeting Microsoft IIS servers with a custom web shell framework. No new developments; continue monitoring web root directories and enforcing web shell detection rules.

IronWorm / npm Supply Chain (ONGOING) Rust-based infostealer with eBPF rootkit distributed via malicious npm packages; continue auditing dependencies and monitoring for unexpected outbound connections from developer workstations.

PCPJack Cloud SMTP Relay Hijacking (ONGOING) Compromised AWS, GCP, and Azure servers being used as covert SMTP relay nodes; audit outbound SMTP from cloud-hosted infrastructure.

SECURITY NEWS AND CONTEXT

Boost Serialization Unpatched Vulnerability (CVE-2026-11460): A proof-of-concept has been published for an input validation flaw in Boost Serialization up to version 1.91. The maintainer acknowledged the issue but has indefinitely postponed a fix. Organizations using Boost Serialization in network-facing applications should assess exposure; no patch is available and the disclosure deadline has expired.

AI-Discovered FFmpeg Zero-Days and Chrome 149: An autonomous AI agent identified 21 previously unknown vulnerabilities in FFmpeg. Google shipped Chrome 149 with a record 429 security bug fixes. CVE assignments for the FFmpeg findings are expected to follow; organizations should inventory FFmpeg usage across their software stack and ensure Chrome 149 is deployed on all managed endpoints.

ChatGPT Lockdown Mode Rollout: OpenAI continues rolling out Lockdown Mode for ChatGPT, restricting tools that could enable data exfiltration via prompt injection. Organizations that have not yet evaluated this feature for accounts handling sensitive data should do so.

Smart TV Proxy Abuse via Bright Data SDK: Research confirms that free consumer apps embedding the Bright Data SDK silently convert devices, including always-on smart TVs, into residential proxy exit nodes. Relevant for organizations investigating anomalous outbound traffic from IoT or BYOD devices on corporate networks.

RECOMMENDED ACTIONS

  1. COMODO INTERNET SECURITY (CVE-2026-49494): Inventory all endpoints running Comodo Internet Security. Block unsolicited IPv6 traffic at the network perimeter and on host-based firewalls as an immediate compensating control. Monitor Comodo’s trust center for a patched driver release.

  2. WORDPRESS THEME AND PLUGIN AUDIT: Immediately remove Seotheme (CVE-2023-54352), Background Image Cropper v1.2 (CVE-2024-58348), Travelscape v1.0.3 (CVE-2024-58349), and Augmented-Reality plugin (CVE-2023-54350) from all managed WordPress installations. Scan theme and plugin directories for unexpected PHP files, particularly mar.php and any files in file_manager or plugin upload directories.

  3. FIFA FRAUD - FINAL ALERT: With the June 11 kickoff imminent, issue final staff awareness communications today. Verify perimeter blocks on known FIFA-themed phishing domains and confirm that banking malware signatures are current in endpoint protection tools.

  4. CISCO SD-WAN MANAGER (CVE-2026-20245): Confirm management plane access is restricted to trusted IP ranges on all deployment types. No patch is available; maintain compensating controls and monitor for privilege escalation.

  5. SOLARWINDS SERV-U (CVE-2026-28318): Confirm 15.5.4 Hotfix 1 is applied. CISA deadline is 2026-06-19; escalate if remediation is not yet complete.

  6. MIASMA WORM: Continue auditing CI/CD pipelines referencing Microsoft GitHub organizations. Do not consume code from disabled repositories until GitHub confirms remediation.

  7. CHROME / FFMPEG: Confirm Chrome 149 deployment across all managed endpoints. Begin FFmpeg inventory in preparation for incoming CVE assignments.

  8. BOOST SERIALIZATION (CVE-2026-11460): Assess whether Boost Serialization is used in any network-facing application in your environment. No patch is available; consider input validation wrappers or sandboxing as compensating controls.

  9. IIS SERVERS (OP-512): Verify web shell detection rules are active on all IIS-hosted applications. Review recent web root changes for unauthorized file additions.

  10. Continue remediation of previously reported items: Cisco UCM (CVE-2026-20230), Mirasvit Full Page Cache Warmer (CVE-2026-45247), Everest Forms Pro (CVE-2026-3300), GL.iNet GL-MT3000 firmware upgrade, Booking Package and MDJM Event Management WordPress plugins, Riello NetMan 204 isolation, X.Org X server patches, ansible-core update, and Hippoo for WooCommerce (CVE-2026-10580).