Two decades
inside the web
as it kept rewriting
itself.

Critical WordPress Core Update (v.7.02)

• WordPress has released an urgent update to version 7.02 to address a critical vulnerability chain [3].
• The WordPress Security Team confirms this update patches flaws that could lead to unauthorized access or remote code execution [1].
• Hackers are actively exploiting these vulnerabilities, prompting official calls for immediate installation [5].

WP2Shell Unauthenticated RCE

• A newly disclosed vulnerability chain, dubbed "WP2Shell," allows attackers to achieve unauthenticated Remote Code Execution (RCE) on affected installations [4].
• Technical analysis indicates the exploit involves chaining multiple flaws to bypass security controls [1][4].

Infrastructure & Provider Impacts

• IONOS: The hosting provider recently shut down several WordPress servers as a security precaution following a cyber attack [9].
• NetNut / Popa Botnet: Researchers have linked the "NetNut" residential proxy provider to the Popa botnet. NetNut's homepage was recently seized by the FBI and IRS [7].

Plugin and Theme Vulnerabilities

• Wordfence Intelligence reported 223 vulnerabilities across 175 WordPress plugins and 6 themes in the past week alone [6].
• Weekly vulnerability disclosures remain high, highlighting the need for automated patching for third-party extensions [2][6].

Incident Response & Defense

• Teams are advised to review evidence collection and recovery processes for web server compromises [8].
• For high-traffic sites (e.g., Drupal), signs that existing hosting security is insufficient include manual WAF management and disjointed patching cycles [10].