Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

WP2Shell: WordPress Core SQLi + REST API Chain to Pre-Auth RCE

A newly disclosed WordPress exploit chain, nicknamed “WP2Shell,” lets unauthenticated attackers achieve remote code execution (RCE) on any WordPress Core installation, no plugins required. Disclosed on July 17, 2026, the chain combines two vulnerabilities: CVE-2026-60137 (SQL injection) and CVE-2026-63030 (REST API batch-route confusion).

SQL injection isn't dead

Oops! A SQL injection bug just forced an emergency WordPress core patch last week. On July 17, WordPress shipped an emergency release to fix an unauthenticated remote code execution flaw in the core, reachable via a SQL injection that an anonymous attacker can exploit on a stock install. WordPress.org even turned on forced auto-updates because of how severe it is. Searchlight Cyber, who reported it, estimates over 500 million sites run WordPress.

Why Reachability Changes Vulnerability Response

When a critical vulnerability is announced, the first response is often urgency—and sometimes panic. But not every vulnerable asset presents the same level of risk. In this video, Daniel dos Santos, VP of Research, explains how reachability helps security teams move beyond broad vulnerability hunting and focus on the assets that are both vulnerable and exposed in ways that matter to the business. By understanding reachability, organizations can prioritize response efforts, reduce noise, and bring structure to vulnerability management.

Security Strategies That Help Minimize Data Breach Risks

Data compromises happen daily, creating massive headaches for companies of all sizes. Cyber criminals constantly find fresh entry points into modern networks. Smart business leaders focus on proactive defense methods to stay ahead of bad actors. Simple systemic upgrades can keep sensitive customer records safe from harm.

Don't trust your eyes - ANSI escape injection in the skills CLI by vercel-labs

In a previous post we looked at the skills CLI by vercel-labs/skills and ways for a malicious skill to overwrite an existing trusted skill by using homoglyph names or abusing weird CLI behaviors. This post will delve into an OSC-8 escape injection we found in the skills add command, which lets a skill author write arbitrary text to the console and clickable links as if it's part of the CLI's output.

Emerging Threat: (CVE-2026-54159) PrestaShop Remote Code Execution via ps_facetedsearch Object Injection

CVE-2026-54159 is a PHP object injection vulnerability in ps_facetedsearch, the layered navigation module bundled with PrestaShop, that lets an unauthenticated attacker run arbitrary code on the storefront. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical).

80% of New Code is AI-Generated - But 40-50% Has Vulnerabilities Find out Why

Is your organization generating up to 80% of its new code with AI? You might be proud of the speed — but are you ready for the security risks? In this video, we reveal the hidden danger: multiple studies show that **40-50% of AI-generated code changes contain vulnerabilities**. Discover why AI coding is accelerating development faster than ever — and why traditional security approaches are no longer enough.

Protecting Vulnerable and Poorly Configured Network Devices

On July 13, 2026, NSA, CISA, the FBI, and co-sealing partners from twelve other countries published AA26-194A, a joint Cybersecurity Advisory (CSA) warning that Center 16 of Russia's Federal Security Service (FSB) continues to exploit vulnerable and poorly configured network devices across the defense industrial base, communications, energy, financial services, government facilities, and healthcare sectors. The advisory does not reference new exploits.