Two decades
inside the web
as it kept rewriting
itself.

WordPress & CMS Vulnerabilities

WordPress Core: XSS2Shell Pre-Auth RCE — A critical exploitation chain (XSS2Shell) allowing unauthenticated attackers to escalate from a login-screen XSS to full PHP code execution [2][5][14].

• CVE / severity: CVE-2026-64638 | CVSS 8.9 (High)
• Affected versions: All WordPress releases prior to 7.0.4 (or relevant security branch update)
• Fixed in: WordPress 7.0.4 / 6.x security patches
• Action now:
  • Update WordPress Core immediately using wp core update.
  • Audit server logs for suspicious activity on wp-login.php involving script injections.

Ajax Search Lite: PHP Object Injection — Failure to sanitize untrusted input allows attackers to perform PHP Object Injection [3].

• CVE / severity: CVE-2026-16258 | Severity not disclosed in sources
• Affected versions: Versions before 4.14.5
• Fixed in: 4.14.5
• Action now:
  • Update via wp plugin update ajax-search-lite.

Drupal Core: Anonymous SQL Injection — A critical vulnerability allowing unauthenticated attackers to execute arbitrary SQL commands [13].

• CVE / severity: CVE-2026-9082 | Severity not disclosed in sources
• Affected versions: Not disclosed in sources
• Fixed in: Latest Drupal security release
• Action now:
  • Apply emergency Drupal security updates immediately.

Hosting & Infrastructure Security

cPanel & WHM: Root Path Traversal & Auth Bypass — Multiple critical flaws allow attackers to read arbitrary files as root or bypass authentication entirely [13].

• CVE / severity: CVE-2026-29205 (Root Path Traversal) and CVE-2026-41940 (Auth Bypass)
• Affected versions: Not disclosed in sources (impacts multi-tenant database security [12])
• Fixed in: Latest cPanel & WHM tier updates
• Action now:
  • Force update cPanel via /scripts/upcp.
  • Implement "High Fidelity" detection checks as recommended by researchers to identify exploit attempts [13].

Nginx/Apache: Path Confusion in PAN-OS — A path confusion flaw between Nginx/Apache proxies and PAN-OS backends leads to authentication bypass [13].

• CVE / severity: CVE-2025-0108 | Severity not disclosed in sources
• Affected versions: Specific PAN-OS integrations with Nginx/Apache
• Fixed in: Latest PAN-OS security hotfixes
• Action now:
  • Update PAN-OS appliances.
  • Review Nginx/Apache proxy configuration rules for URI normalization inconsistencies.

Active Campaigns & Mitigation

'wp2shell' Active Exploitation — F5 Labs and Searchlight Cyber have confirmed active exploitation of the wp2shell chain (CVE-2026-63030 and CVE-2026-60137) targeting WordPress sites to gain shell access [4][14].

• Indicators of Compromise (IoC): Look for specific POST requests targeting core files and unauthorized PHP file creation in wp-content/uploads or core directories.
• Mitigation: Deploy WAF rules specifically filtering the payloads identified in the F5 Labs report [4].

Mass Plugin Vulnerability Wave — Over 224 vulnerabilities were disclosed across 177 plugins and 2 themes in the last week, signaling a high-volume supply chain risk [1].

• Action now:
  • Run wp plugin list --update=available and patch all components.
  • Hosting providers should consider integrating automated malware scanners like Monarx or Imunify360 to mitigate zero-day plugin exploits [6].