Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution
Excerpt
On July 17, 2026, Searchlight Cyber disclosed wp2shell , a pre-authentication remote code execution chain in WordPress Core ( CVE-2026-63030 , CVE-2026-60137 ). Proof-of-concept tools hit GitHub within hours. hashkitten published the chain after PoCs started circulating, including a write-up of how the bug was found . Scanning followed immediately, and we are already seeing the same host footprint in customer telemetry: PHP and web server runtimes spawning shells, plugin…
Read the original report →Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-63030 | High | Score 78/100 | First seen |
| CVE | CVE-2026-60137 | High | Score 74/100 | First seen |
IOC Relationship Graph
Building graph…