✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Media Production
Breach intelligence, attack campaigns, and threat reports targeting the Media Production sector.
Explore Other Sectors
Media Production Threat Reports
Critical wp2shell WordPress Flaws Exploited to Install Webshells
In July 2026, a critical vulnerability chain known as "wp2shell" (CVE-2026-63030 and CVE-2026-60137) was discovered in WordPress Core, allowing unauthenticated remote code execution. Attackers exploited these flaws to deploy persistent webshells and install malicious plugins on vulnerable servers. The exploit leverages the WordPress REST API's batch-processing feature, enabling code execution without authentication. WordPress addressed the issue in versions 7.0.2, 6.9.5, and 6.8.6, prompting automatic security updates for supported installations. The rapid emergence of proof-of-concept exploits and active exploitation underscores the urgency for organizations to update their WordPress installations promptly. This incident highlights the critical need for timely patch management and vigilant monitoring of web applications to prevent unauthorized access and potential data breaches.
4 hours ago
Kill Chain
WP2Shell: Unauthenticated RCE Threatens Millions of WordPress Sites
In July 2026, two critical vulnerabilities in WordPress Core, identified as CVE-2026-60137 and CVE-2026-63030, were disclosed. When exploited together, these flaws, collectively termed 'WP2Shell,' allow unauthenticated remote code execution on default WordPress installations. CVE-2026-60137 is an SQL injection vulnerability in the 'author__not_in' parameter of WP_Query, while CVE-2026-63030 is a REST API batch-route confusion issue. Attackers have rapidly developed and disseminated proof-of-concept exploits, leading to widespread exploitation attempts against millions of WordPress sites worldwide. Organizations are urged to update to the latest WordPress versions immediately to mitigate this threat. ([vulncheck.com](https://www.vulncheck.com/blog/wp2shell?utm_source=openai)) The rapid exploitation of WP2Shell underscores the increasing sophistication and speed of threat actors in leveraging newly disclosed vulnerabilities. This incident highlights the critical importance of timely patching and proactive security measures to protect web assets from emerging threats.
11 hours ago
Kill Chain
WordPress wp2shell Vulnerabilities: Immediate Action Required
In July 2026, two critical vulnerabilities in WordPress, identified as CVE-2026-63030 and CVE-2026-60137, collectively termed 'wp2shell,' were disclosed. These flaws enable unauthenticated remote code execution (RCE) on default WordPress installations, allowing attackers to fully compromise affected websites. Exploitation began shortly after public disclosure, with attackers deploying persistent webshells and exfiltrating hashed credentials. The vulnerabilities impact WordPress versions 6.9.0 through 7.0.1, with patches available in versions 6.9.5 and 7.0.2. Organizations are urged to apply these updates promptly to mitigate the risk of exploitation. The rapid exploitation of wp2shell underscores the critical need for timely patch management and robust security measures. With WordPress powering a significant portion of the web, the widespread impact of these vulnerabilities highlights the importance of proactive vulnerability management and continuous monitoring to safeguard digital assets.
11 hours ago
Kill Chain
Urgent: Patch Critical WordPress Vulnerabilities CVE-2026-63030 & CVE-2026-60137
In July 2026, two critical vulnerabilities, CVE-2026-63030 and CVE-2026-60137, were discovered in WordPress Core versions 6.8.0 through 7.0.1. These flaws, collectively termed "wp2shell," allow unauthenticated attackers to execute remote code by exploiting a REST API route confusion and an SQL injection vulnerability. The exploitation enables full control over affected WordPress sites, including data access, malicious code installation, and administrative privileges. ([threatprotect.qualys.com](https://threatprotect.qualys.com/2026/07/20/wordpress-wp2shell-vulnerabilities-exploited-in-the-wild-cve-2026-63030-cve-2026-60137/?utm_source=openai)) The widespread use of WordPress, powering over 500 million websites, amplifies the impact of these vulnerabilities. ([threatprotect.qualys.com](https://threatprotect.qualys.com/2026/07/20/wordpress-wp2shell-vulnerabilities-exploited-in-the-wild-cve-2026-63030-cve-2026-60137/?utm_source=openai)) Public proof-of-concept exploits have been released, and active exploitation has been observed in the wild, underscoring the urgency for immediate remediation.
12 hours ago
Kill Chain
Urgent: Patch Critical 'wp2shell' Vulnerabilities in WordPress Core
In July 2026, critical vulnerabilities known as 'wp2shell' were discovered in WordPress Core, affecting versions 6.9.x and 7.0.x. These flaws, identified as CVE-2026-63030 and CVE-2026-60137, allow unauthenticated attackers to execute remote code on default WordPress installations without any plugins. The vulnerabilities stem from a REST API batch-route confusion and an SQL injection in the 'author__not_in' parameter of 'WP_Query'. WordPress has released patches in versions 6.9.5 and 7.0.2 to address these issues. The release of public proof-of-concept exploits has heightened the urgency for administrators to update their WordPress installations immediately. Given that WordPress powers over 500 million websites, the potential impact is vast, making prompt patching critical to prevent widespread exploitation.
3 days ago
Kill Chain
Global CMS Exploitation Campaign: Protect Your Website Now
In July 2026, the Australian Cyber Security Centre (ACSC) issued an alert regarding a global exploitation campaign targeting vulnerabilities in content management systems (CMS) and associated plugins. Threat actors are actively scanning websites to deploy webshells, leveraging flaws in platforms such as WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE. This campaign has significantly impacted small to medium-sized Australian businesses, leading to service disruptions, credential theft, malware deployment, and potential lateral movement within networks. The ACSC highlighted that the campaign might be supported by artificial intelligence, enabling threat actors to accelerate attacks and scale the exploitation of emerging vulnerabilities. Website administrators are urged to apply the latest security updates, remove unused components, enable automatic updates where possible, and implement additional security measures to mitigate the risk of compromise.
1 week ago
Kill Chain
WP-SHELLSTORM: A Massive Exploitation of WordPress Vulnerabilities
In June 2026, cybersecurity researchers uncovered a large-scale operation named WP-SHELLSTORM, which exploited vulnerabilities in outdated WordPress plugins to compromise thousands of websites. The attackers utilized known flaws, notably in the Breeze caching plugin (CVE-2026-3844), to deploy webshells, granting unauthorized access to affected sites. This operation targeted over 1.4 million domains, with confirmed compromises on approximately 25,195 sites. The exposed server provided insights into the attackers' methods, including automated scanning and exploitation of vulnerable plugins. This incident underscores the critical importance of maintaining up-to-date software and implementing robust security measures. The widespread nature of the attack highlights the persistent threat posed by cybercriminals exploiting known vulnerabilities, emphasizing the need for continuous vigilance and proactive defense strategies in website management.
1 week ago
Kill Chain
Interpol Impersonation Ransomware Targets Small Businesses in 2026
In July 2026, a ransomware campaign targeted small businesses across multiple regions, including the US, Europe, Asia, and the Middle East. Attackers impersonated Interpol officials, sending phishing emails that claimed the recipient's organization was under investigation for suspicious activity. These emails urged recipients to download a password-protected archive from Proton Drive, purportedly containing evidence. Upon opening, the archive delivered a ransomware payload disguised as a video file, encrypting local systems and prompting victims to contact the attackers via the Tox messaging platform to negotiate payment. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/attackers-use-interpol-lure-target-small-businesses?utm_source=openai)) This incident underscores the increasing trend of cybercriminals leveraging social engineering tactics to exploit small businesses, which often lack dedicated cybersecurity resources. The campaign highlights the need for heightened awareness and robust security measures to defend against such deceptive attacks.
2 weeks ago
Kill Chain
Urgent Alert: Oracle E-Business Suite Vulnerability Under Active Exploitation
In late June 2026, threat intelligence firm Defused reported active exploitation of a critical vulnerability (CVE-2026-46817) in Oracle E-Business Suite's Payments component. This flaw, present in versions 12.2.3 through 12.2.15, allows unauthenticated attackers with HTTP access to execute remote code, potentially leading to full system compromise. Oracle had addressed this issue in their May 2026 Critical Security Patch Update, urging immediate patching. Despite this, numerous unpatched systems remain exposed, with over 450 Oracle EBS instances accessible online, nearly 200 of which are in the United States and Europe. The active exploitation of CVE-2026-46817 underscores the critical importance of timely patch management. Organizations using Oracle E-Business Suite must prioritize applying the latest security updates to mitigate this severe risk. Additionally, this incident highlights the broader trend of attackers targeting unpatched enterprise applications, emphasizing the need for robust vulnerability management practices.
3 weeks ago
Kill Chain
Critical Vulnerability in Popular Chrome Extension Puts Millions at Risk
In June 2026, security researchers discovered that the popular Chrome extension 'Adblock for YouTube' (ID: cmedhionkhpnakcndndgjdbohmhepckk), with over 11 million installs, contained a dormant capability to execute arbitrary JavaScript code on any website. This vulnerability could be activated remotely by a server-side configuration change, potentially allowing attackers to read user data, steal sensitive information, and perform actions on behalf of the user across various web applications. The extension's permissions and architecture facilitated this exploit without requiring an update or user intervention, posing a significant security risk to its extensive user base. This incident underscores the growing threat posed by malicious or compromised browser extensions, especially those with large user bases and extensive permissions. As browser ecosystems evolve, the potential for such extensions to be weaponized increases, highlighting the need for rigorous security assessments, continuous monitoring, and user education to mitigate risks associated with third-party extensions.
3 weeks ago
Kill Chain
ShapedPlugin WordPress Pro Plugins Compromised in Supply Chain Attack
In June 2026, ShapedPlugin, a developer of premium WordPress plugins, experienced a supply chain attack where attackers compromised the company's update infrastructure. This breach led to the distribution of backdoored versions of several plugins, including Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro. The malicious code, activated upon administrator access to the WordPress dashboard, connected to a command-and-control server to download additional payloads, resulting in unauthorized access and data exfiltration. ([thaicert.or.th](https://www.thaicert.or.th/en/2026/06/19/supply-chain-attack-through-shapedplugin-update-system-impacts-wordpress-websites/?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting trusted software vendors. It highlights the critical need for organizations to implement robust security measures, including regular code audits and monitoring of update channels, to prevent similar compromises.
4 weeks ago
Kill Chain
Critical Vulnerability in Gravity SMTP Plugin Exposes API Keys
In June 2026, a significant security vulnerability (CVE-2026-4020) was discovered in the Gravity SMTP WordPress plugin, affecting approximately 100,000 websites. This flaw allowed unauthenticated attackers to access sensitive information, including API keys and configuration data, through an improperly secured REST API endpoint. Exploitation of this vulnerability enabled threat actors to harvest credentials and gain insights into the site's software stack, potentially facilitating further attacks. The incident underscores the critical importance of promptly updating plugins and securing REST API endpoints to prevent unauthorized data exposure. It also highlights the need for website administrators to regularly audit and monitor their systems for vulnerabilities to mitigate the risk of exploitation.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports