🚨 ACTIVE EXPLOITATION
- Critical WordPress 'wp2shell' RCE flaws get public exploits, patch now — bleepingcomputer.com
Public exploits released for critical pre-authentication remote code execution vulnerabilities in WordPress Core.- Affects WordPress Core versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1
- Two chained vulnerabilities: CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection)
- Allows unauthenticated remote code execution on default WordPress installs with no plugins
- Exploits use SQL injection to extract password hashes, crack admin credentials, upload malicious plugins, or achieve RCE without credentials
- Public proof-of-concept exploits and in-the-wild attacks reported after delayed disclosure
🕵️ RESEARCH & DEEP DIVES
Four-Stage Bitmap-Steganography Dropper Delivers AsyncRAT 0.5.8 via .NET Chain — blog.threatuniverse.co.uk
A four-stage .NET dropper uses bitmap steganography to deliver AsyncRAT 0.5.8.- Targets Windows .NET Framework 4.5 with a multi-stage loader disguised as Armenian water-cycle simulation
- Uses two bitmap resources with distinct pixel-encoding steganography carrying encrypted payloads
- Stages include ConfuserEx and Eazfuscator obfuscation, Defender tampering, persistence, and process hollowing
- Final payload is AsyncRAT 0.5.8 with disabled installation and anti-analysis features, communicating via TLS to dynamic DNS C2
- Static analysis extracted all stages and config without execution; loader embeds legitimate epidemiology simulator as cover
AstrBot API suffers authentication and authorization bypass vulnerabilities up to version 4.25.5 — cve.threatint.com
AstrBot API up to version 4.25.5 has authentication and authorization bypass vulnerabilities.- Applies to AstrBotDevs AstrBot versions up to 4.25.5
- Vulnerabilities in API functions OpenApiRoute.chat_send and OpenApiRoute.get_chat_sessions
- Authentication bypass via spoofing Username argument in chat_send function
- Authorization bypass via manipulation of Username argument in get_chat_sessions function
- Both vulnerabilities allow remote exploitation and have publicly disclosed exploits
Insecure PRNG in urwid Web Backend Exposes Session IDs and Enables Code Injection — cve.threatint.com
The urwid web display backend uses a weak PRNG that exposes session IDs and allows code injection.- Applies to all versions of the urwid web display backend (urwid/display/web.py)
- Session IDs (urwid_id) are generated using Python's Mersenne Twister PRNG, which is not cryptographically secure
- An attacker observing ~334 session IDs can reconstruct the PRNG state to predict past and future IDs
- Session IDs are used as filenames in a world-listable /tmp directory, allowing local users to enumerate active sessions
- With a valid session ID, attackers can read terminal screens, inject keystrokes, and execute OS-level code with session owner privileges
🔓 CVEs & KEV
- CVE-2026-16128 — CVSS 7.3
- CVE-2026-16127 — CVSS 7.3
- CVE-2026-16126 — CVSS 7.3
- CVE-2026-16125 — CVSS 7.3
- CVE-2026-16124 — CVSS 6.3
- CVE-2026-16123 — CVSS 6.3
- CVE-2026-16129 — CVSS 5.3