🔴 WP2Shell WordPress RCE, 🔴 NGINX 15-Year Heap Overflow, 🤖 Hugging Face AI Agent Breach, 🎯 HelloNet ViPNet Campaign

The wp2shell chain is the day's defining story. Two WordPress core bugs, a SQL injection and an interpretation conflict, chain into unauthenticated remote code execution on default installations with no plugins and no user interaction, and exploitation is already in the wild. wp2shell patches landed July 17 in 6.9.5 and 7.0.2, but exposure spans hundreds of millions of sites and PoCs are public. Treat unpatched installs as compromised.

The NGINX heap overflow disclosed out of band is the quieter version of the same problem. A missing PCRE capture-state save, exploitable since 2011, yields reliable pre-auth RCE with ASLR defeated, and the F5 release is only days old. Any config mixing regex captures with regex-based map variables is suspect.

The Hugging Face breach is the first publicly confirmed intrusion run end-to-end by an autonomous AI agent: 17,000 recorded actions, lateral movement across internal clusters, credentials harvested, and self-migrating C2 staged on public services. Defender analysis was blocked by hosted model safety guardrails while the attacker faced none. That asymmetry is an operational gap, not a curiosity.

HelloNet continues in the background, abusing the ViPNet update mechanism to sideload backdoors into Russian government, energy and transport networks.

Watchlist: wp-json batch endpoint traffic, map-plus-regex NGINX configs, and ViPNet update directories on any in-scope systems.