Daily · 2026-07-19
🔴 wp2shell Active Exploitation, ⚠️ 7-Zip RCE Patch, 🎯 ACR Stealer Surge, 📋 CISA BOD 26-04 Deadline Today
wp2shell pre-auth WordPress RCE now has public exploits and confirmed in-the-wild exploitation; CISA BOD 26-04 deadlines for SharePoint and FortiSandbox arrive today; 7-Zip patches critical XZ decompression RCE; Microsoft details ACR Stealer surge via ClickFix delivery chains.
wp2shell moved from disclosure to exploitation within a day. Public proof-of-concept exploits are circulating, watchTowr reports the first signs of in-the-wild use, and WordPress has enabled forced automatic updates for affected versions. The chain pairs a REST API batch-route confusion with an SQL injection in WP_Query, and it works on a default installation with no plugins, putting hundreds of millions of sites in scope. CVE-2026-63030 (wp2shell): Critical Pre-Auth WordPress Core RCE
July 19 is the CISA BOD 26-04 remediation deadline for the SharePoint RCE and the two FortiSandbox command injection flaws, and the SonicWall SMA1000 deadline passed two days ago. Federal agencies should attest; everyone else should treat today as the hard date.
The 7-Zip fix matters because the XZ heap overflow needs only a malicious archive and 7-Zip has no auto-update, so vulnerable versions persist until someone installs 26.02 manually. 7-Zip 26.02: RCE via Heap-Based Buffer Overflow in XZ Decompression Microsoft's ACR Stealer report documents two enterprise intrusion chains built on ClickFix lures that pull payloads over WebDAV and MSHTA, with one variant using blockchain dead drops for C2. The delivery method is social engineering first, technology second.
Watchlist: confirm every internet-facing WordPress install is at 6.9.5 or 7.0.2, deploy 7-Zip 26.02, and restrict rundll32 and mshta from launching remote content.