Daily · 2026-07-18
🔴 CVE-2026-63030 wp2shell WordPress RCE, 🔴 Abbott Labs ShinyHunters Breach, ⚠️ HollowByte OpenSSL DoS, 🎯 TKMS Naval Defense Ransomware, 🛡️ AI Agent RCE via WhatsApp
Critical pre-auth RCE in WordPress Core (wp2shell) dominates alongside SharePoint RCE detection signatures. ShinyHunters breaches Abbott Labs via Entra SSO vishing, The Gentlemen claim 1TB+ from naval defense firm TKMS, and a silent OpenSSL DoS fix highlights sub-CVE hardening gaps.
The day's defining story is wp2shell, a pre-authentication remote code execution in WordPress core disclosed through a GitHub advisory. The flaw reaches the REST API batch endpoint on default installations with no plugins, fixes are in 6.9.5 and 7.0.2, and WordPress is forcing updates for affected installs. WordPress runs about 43 percent of the web, so an unauthenticated RCE with no plugin requirement is close to a universal target. CVE-2026-63030 (wp2shell): Critical Pre-Auth WordPress Core RCE
The OpenClaw demonstration is the second AI agent breach in days: a WhatsApp message executes code on the host through an architectural flaw, not prompt injection. Any agent with messaging access and host commands needs its sandboxing boundaries reviewed. OpenClaw AI Agent RCE via WhatsApp: Arbitrary Code Execution Through AI Agent Architectural Flaw
ShinyHunters claims Abbott Laboratories access through a vishing attack on an Entra SSO account, with tens of millions of records allegedly taken from connected SaaS applications. The Gentlemen claims a Thyssenkrupp Marine Systems breach with over 1TB exfiltrated, and EY disclosed a breach of a third-party support system holding client tax data. HollowByte shows the quiet end of disclosure: an 11-byte TLS payload bloats OpenSSL server memory, and the fix shipped without a CVE, so inventory upgrades are the only protection.
Watchlist: patch WordPress immediately, block the batch endpoint at the WAF, and upgrade OpenSSL builds to the fixed versions.