wp2shell: The WordPress Core RCE That Proves the Patch Was Never the Hard Part

wp2shell pre-auth RCE in WordPress core (CVE-2026-63030 + CVE-2026-60137). A two-bug chain — a REST batch-route confusion plus a WP_Query SQL injection — yields unauthenticated remote code execution against stock WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1, patched in 6.9.5 and 7.0.2 with forced auto-updates. It was reported by Adam Kues of Assetnote / Searchlight Cyber, and a public exposure checker exists while full exploit details were withheld.

So what: The patch shipped in minutes; knowing which of your public sites actually run the vulnerable path — reachable and unpatched — is the work that’s left.

An Inc-ransomware affiliate is chaining two SonicWall SMA1000 zero-days to root. Rapid7’s MDR team found active, targeted exploitation of internet-facing SonicWall SMA1000 appliances since at least late June, attributed to an affiliate of the Inc ransomware group. The chain pairs CVE-2026-15409 (CVSS 10.0, unauthenticated SSRF) with CVE-2026-15410 (CVSS 7.2, post-authentication command injection) to move from outsider to root, harvest credentials, and stage ransomware; both were added to CISA’s KEV on July 14, and SonicWall has shipped fixes.

So what: Your remote-access edge is a primary target — inventory internet-facing appliances and route the first patch windows to the exploited-and-reachable set.

Kudankulam nuclear-plant files surface via a contractor breach; India’s NPCIL says no safety systems were exposed. The World Leaks extortion group posted roughly 19,000 files (part of a larger ~858,000-file cache) tied to India’s Kudankulam Nuclear Power Plant, including purported facility blueprints dated 2016 to mid-2025. The data traces not to the plant’s operational systems but to contractor Reliance Group, which told Reuters it suffered a partial breach on a server hosted by a third-party data-center provider. India’s Nuclear Power Corporation stated the exposed material pertains only to common service facilities and does not touch nuclear safety or security systems.

So what: The scary headline and the accurate story differ — a contractor’s document server was breached, not a reactor. That gap is exactly where supply-chain risk lives: your crown-jewel data is only as protected as the least-monitored vendor holding a copy.

A new extortion crew’s Synopsys and Bosch “breach” looks more like theater than access. A group calling itself D1R listed chip-design firm Synopsys and Bosch on its leak site with an 11-day countdown, claiming a 40,000-record client database and Bosch engineering data. Synopsys investigated and says it found no evidence of unauthorized access, has not been contacted by the actor, and considers the claims unfounded; one piece of offered proof appears to be a publicly available document.

So what: Treat unverified leak-site listings as marketing until proven otherwise — an unchallenged claim is itself the attack.

The agentic SOC is shipping faster than the telemetry to govern it. Coverage of the 2026 agentic-SOC buildout — with major vendors all shipping security agents — keeps surfacing the same unmet gap: the tools give agents authority to reason and act at machine speed, but the industry still lacks a behavioral baseline for the agents themselves, the “what is normal for this agent” telemetry you’d need to catch a compromised or manipulated one.

So what: As agents gain real tools and reach, the surviving control is watching and constraining what the agent actually does — not trusting that it will behave.