Daily Threat Briefing
← All briefings

WordPress Core · Windows Local Privilege Escalation Zero-Day · Multiple Critical Vulnerabilities

Daily Threat Intelligence Briefing

Date: 2026-07-18 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

A critical unauthenticated RCE in WordPress Core (CVE-2026-63030, dubbed “wp2shell”) was disclosed yesterday, affecting all 6.9.x and 7.0.x installations; patches are available and forced auto-updates are rolling out. A Windows local privilege escalation zero-day (“LegacyHive”) has been publicly released with no patch available. IBM Langflow OSS received a sweeping batch of critical vulnerabilities — including unauthenticated RCE chains — that demand immediate attention for any organization running self-hosted AI workflow infrastructure. The NadMesh botnet is actively targeting exposed AI services including Langflow instances.

Critical Vulnerabilities

CVE-2026-63030 — WordPress Core (Unauthenticated RCE, “wp2shell”)

  • Severity: CVSS 7.5 (classified Critical by GitHub Security Advisory)
  • EPSS: Not yet scored
  • Technical detail: An unauthenticated attacker can execute arbitrary code via the WordPress REST API batch endpoint. The vulnerable code path is reachable on default WordPress installations with no plugins required, provided a persistent object cache is not in use. Affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Given WordPress’s open-source nature, Rapid7 assesses a public PoC is likely imminent. No authentication or user interaction is required.
  • Exploitation status: No confirmed in-the-wild exploitation as of 2026-07-17 17:45 ET; however, the unauthenticated attack path and massive deployment footprint make this extremely high risk.
  • Remediation: Upgrade to WordPress 6.9.5 or 7.0.2 immediately. WordPress is forcing auto-updates for affected installations — verify each internet-facing site has successfully updated. No reliable workaround exists.

LegacyHive — Windows Local Privilege Escalation Zero-Day (No CVE Assigned)

  • Severity: No CVSS yet; enables admin-level privilege escalation on fully patched Windows systems
  • EPSS: N/A
  • Technical detail: A researcher using the handle “Nightmare Eclipse” publicly released a working exploit dubbed LegacyHive that escalates privileges to administrator on up-to-date Windows systems. No CVE has been assigned and no patch is available. The exploit targets a legacy registry hive handling mechanism. Public exploit availability significantly raises the risk of rapid adoption by threat actors.
  • Exploitation status: No confirmed in-the-wild exploitation yet; public exploit code released.
  • Remediation: No patch available. Monitor for anomalous privilege escalation activity via EDR telemetry; apply principle of least privilege; review Windows audit policies for registry access events. Track Microsoft’s response for an out-of-band patch.

IBM Langflow OSS — Multiple Critical Vulnerabilities (RCE, Auth Bypass, Privilege Escalation)

  • Severity: CVSS 9.9 (multiple CVEs); CVSS 9.8 (multiple CVEs)
  • EPSS: 0 (newly published); note NadMesh botnet is actively scanning for exposed Langflow instances
  • Technical detail: IBM disclosed a sweeping set of critical vulnerabilities in Langflow OSS 1.0.0–1.10.x. The most severe include: CVE-2026-8481 / CVE-2026-8476 / CVE-2026-9135 (CVSS 9.9) — unauthenticated or authenticated RCE via the code validation API, unsafe pickle.loads() deserialization, and code injection in the ToolGuard component; CVE-2026-9198 (CVSS 9.8) — unauthenticated chain of /api/v1/auto_login (mints SUPERUSER tokens to any caller) with /api/v1/validate/code (executes arbitrary code), enabling full system compromise with no credentials; CVE-2026-8635 (CVSS 9.9) — authenticated privilege escalation to superuser via direct database manipulation; CVE-2026-13446 (CVSS 9.8) — hard-coded credentials usable for authentication bypass; CVE-2026-8505 (CVSS 9.8) — unauthenticated webhook trigger bypassing authentication. The NadMesh botnet (see Active Threats) is actively scanning for exposed Langflow instances and harvesting cloud credentials from compromised deployments.
  • Exploitation status: No CVE-specific exploitation confirmed; NadMesh actively targeting exposed Langflow endpoints.
  • Remediation: Upgrade to Langflow OSS 1.10.2 or later (verify vendor advisory for exact fixed version per CVE). Do not expose Langflow to the internet. Rotate all credentials and API keys on affected instances. Audit for unauthorized superuser accounts.

CVE-2026-58644 — Microsoft SharePoint Server (Deserialization RCE, KEV)

  • STATUS CHANGE: CISA KEV deadline of 2026-07-19 is tomorrow. No new technical developments, but deadline urgency warrants a reminder.
  • Covered in full in yesterday’s report. Apply July 14 SharePoint cumulative updates immediately. Enable AMSI integration and monitor for Exploit:Script/ToolPaneAuthBypass.A detections.

CVE-2026-60137 — WordPress (SQL Injection via WP_Query)

  • Severity: CVSS 9.1
  • EPSS: 0 (newly published)
  • Technical detail: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 fails to sanitize the author__not_in parameter of WP_Query, enabling SQL injection when a plugin or theme passes this parameter with user-supplied input. This is distinct from CVE-2026-63030 and is fixed in the same patch releases (6.9.5, 7.0.2). Organizations patching for wp2shell will remediate this simultaneously.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Upgrade to WordPress 6.8.6, 6.9.5, or 7.0.2 — same update addresses both WordPress CVEs reported today.

ONGOING:

  • CVE-2026-25089 / CVE-2026-39808 (Fortinet FortiSandbox): actively exploited, CISA KEV deadline 2026-07-19 — patch today.
  • CVE-2026-58644 (SharePoint RCE): actively exploited, CISA KEV deadline 2026-07-19 — patch today.
  • CVE-2026-15409 (SonicWall SMA1000): public PoC available; treat unpatched appliances as compromised.
  • CVE-2026-53412 (Zoom for Windows, CVSS 9.8): patch to 7.0.0+.
  • CVE-2026-44182/44181/44180 (Jupyter Enterprise Gateway, CVSS 10.0): upgrade to 3.3.0+.
  • CVE-2026-56164 / CVE-2026-56155 (SharePoint EoP / AD FS, KEV): patch now.
  • CVE-2026-55255 (Langflow, actively exploited): patch immediately.
  • CVE-2026-44747 (SAP NetWeaver ABAP, CVSS 9.9): patch immediately.

European Advisories

BSI — New advisories (2026-07-17):

`WID-SEC-2026-2400` (NEU, hoch) — Microsoft Office 365 Moodle Plugin: An unauthenticated remote attacker can bypass security controls, impersonate users, and escalate to administrator access. Relevant for European higher education and enterprise environments using Moodle with Microsoft 365 integration. Apply available plugin updates immediately.

`WID-SEC-2026-2398` (NEU, hoch) — Google Chrome (second unscheduled update this week): Multiple vulnerabilities enabling memory corruption, arbitrary code execution, data manipulation, and DoS. BSI also updated the prior Chrome advisory (WID-SEC-2026-2347). Deploy the latest Chrome stable release across all managed endpoints; this is the second out-of-cycle Chrome update this week, indicating elevated urgency.

`WID-SEC-2026-2393` (NEU, hoch) — Ubuntu Linux (ubuntu-pro-client): Multiple vulnerabilities allowing arbitrary code execution with administrator privileges and sensitive information disclosure. Apply Ubuntu Pro client updates via standard package management.

`WID-SEC-2026-2390` (NEU, hoch) — nginx-ui: Multiple vulnerabilities enabling RCE including root-level code execution, privilege escalation, account takeover, security bypass, and data disclosure/manipulation. Apply nginx-ui updates; restrict management interface access.

BSI — Updated advisories (2026-07-17): `WID-SEC-2026-1686` Samba (kritisch, updated — RCE, DoS, file manipulation, security bypass); `WID-SEC-2026-2317` Microsoft Office products (kritisch, updated); `WID-SEC-2026-1959` Mozilla Firefox/ESR/Thunderbird (hoch, updated). Apply current vendor patches for all three. Multiple Linux Kernel, Red Hat, libssh2, FasterXML Jackson, HAProxy, Golang, and memcached advisories also updated — apply distribution patches via standard patch management.

Active Threats and Campaigns

NEW — NadMesh Botnet (AI service targeting, cloud credential harvesting): A Go-based botnet called NadMesh, active since early July, uses Shodan to identify and attack exposed AI services including Langflow, ComfyUI, Ollama, n8n, Open WebUI, and Gradio. The operator’s dashboard reportedly claims 3,811 harvested AWS keys. The botnet exploits the pattern of teams deploying AI tooling rapidly without adequate network controls. Audit internet exposure of all AI/ML service endpoints immediately; enforce authentication and network segmentation.

NEW — ViteVenom / ChainVeil (npm supply chain, blockchain C2, RAT delivery): Checkmarx identified seven malicious npm packages targeting the Vite frontend ecosystem as part of the ChainVeil campaign. The packages use a four-tier blockchain-based C2 infrastructure spanning the Tron network to deliver a RAT. This represents a significant supply chain risk for JavaScript/frontend development pipelines. Audit npm dependencies for Vite-adjacent packages; enforce lockfile integrity checks and registry allowlisting.

NEW — ACR Stealer (ClickFix delivery, browser tokens, M365 document theft): ACR Stealer is being distributed via ClickFix social engineering lures, exfiltrating saved browser credentials, live session tokens, PDFs, and Microsoft 365 documents including OneDrive/SharePoint-synced files. Microsoft Defender Experts documented two delivery chains. Block ClickFix-style lures via browser policy; monitor for unexpected script execution from Run dialog.

NEW — CrashStealer (macOS, impersonates Apple tools): A new macOS infostealer impersonating Apple system tools is circulating, targeting credentials and cryptocurrency wallets. Relevant for macOS endpoints in enterprise environments. Enforce macOS Gatekeeper and notarization requirements; monitor for unsigned or impersonation-named binaries.

ONGOING — UAT-11795 / Starland RAT: trojanized WebEx/Zoom installers, European targets confirmed; verify installer integrity, review Talos IOCs. ONGOING — TELEPUZ malware (ClickFix): modular data theft/RCE; block ClickFix lures. ONGOING — Contagious Interview / OtterCookie-aligned SVG steganography: fake coding tests targeting developers; brief staff on unsolicited coding challenge risks.

Security News and Context

WordPress wp2shell (CVE-2026-63030): Unauthenticated RCE in WordPress Core disclosed 2026-07-17; patches 6.9.5 and 7.0.2 released with forced auto-updates. Full detail in Critical Vulnerabilities. (Rapid7, The Hacker News)

OpenSSL “HollowByte” DoS: An 11-byte TLS request can cause an unpatched OpenSSL server to allocate up to 131 KB of memory that is never freed until process restart. The fix was silently shipped in June with no CVE or advisory; Okta’s Red Team named and disclosed it. Verify OpenSSL versions are current. (Bleeping Computer)

Ernst & Young data breach: EY disclosed a breach of a third-party IT support ticket system, resulting in customer data exposure. (Bleeping Computer)

7-Zip code execution flaw: A new 7-Zip update patches a code smuggling vulnerability triggered by malformed xz-compressed archives. Update 7-Zip across all endpoints. (Heise Security)

VMware Avi Load Balancer: Critical authentication and authorization bypass vulnerabilities disclosed. (Heise Security)

GoldenEyeDog / DigiCert breach attribution: The April 2026 DigiCert incident and code-signing certificate theft has been attributed to CylindricalCanine, a subgroup of Chinese cybercrime cluster GoldenEyeDog (APT-Q-27). (The Hacker News)

  1. Patch WordPress to 6.9.5 / 7.0.2 immediately — remediates both CVE-2026-63030 (unauthenticated RCE) and CVE-2026-60137 (SQLi); verify auto-updates completed on all internet-facing sites.
  2. Patch Fortinet FortiSandbox (CVE-2026-25089, CVE-2026-39808) — CISA KEV deadline today (2026-07-19); restrict management interfaces to trusted IPs.
  3. Patch Microsoft SharePoint (CVE-2026-58644) — CISA KEV deadline today (2026-07-19); verify AMSI integration is enabled.
  4. Isolate or upgrade all IBM Langflow OSS instances — multiple CVSS 9.8–9.9 RCE/auth-bypass CVEs; NadMesh botnet actively scanning; do not expose to internet; rotate all credentials.
  5. Monitor for LegacyHive Windows LPE exploitation — no patch available; increase EDR alerting on privilege escalation and registry hive access; apply least-privilege controls.
  6. Update Google Chrome across all managed endpoints — second unscheduled update this week per BSI WID-SEC-2026-2398.
  7. Update 7-Zip on all endpoints — code execution via malformed xz archives.
  8. Audit npm dependencies for Vite-adjacent packages (ViteVenom/ChainVeil campaign); enforce lockfile integrity and registry allowlisting in CI/CD pipelines.
  9. Audit internet-exposed AI service endpoints (Langflow, ComfyUI, Ollama, n8n, Open WebUI, Gradio) — NadMesh actively harvesting cloud credentials from exposed instances.
  10. Continue remediation of previously reported items: CVE-2026-56164 / CVE-2026-56155 (SharePoint/AD FS KEV), CVE-2026-15409 (SonicWall SMA1000), CVE-2026-53412 (Zoom), CVE-2026-44182 cluster (Jupyter), CVE-2026-55255 (Langflow), CVE-2026-44747 (SAP NetWeaver).