Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)
Excerpt
wp2shell is a critical, unauthenticated remote code execution vulnerability in WordPress core shared with the public on July 17th, 2026. It requires no plugins, no theme, and no login. It was discovered and disclosed by Adam Kues of Searchlight Cyber , who published an official advisory and a live vulnerability checker at wp2shell.com . Credit for the discovery and the checker belongs entirely to their team. At Eye Security , we were among the first responders. WordPress.org…
Read the original report →Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-63030 | High | Score 78/100 | First seen |
| CVE | CVE-2026-60137 | High | Score 74/100 | First seen |
IOC Relationship Graph
Building graph…