Checks if your site is exposed to, or was hacked through, PHP2Shell (critical PHP bug) and wp2shell (WordPress bug). Optional fixes you can undo.

1. はじめに 三菱電機の木原です。 三菱電機 情報技術総合研究所では、製品開発時のセキュリティ対策にフィードバックする目的で、複数種類のハニーポットを設置・運用しています。 今回はIoT家電を標的としたサイバー攻撃を観測するハニーポット「IoT家電ハニーポット」で観測し...

Sensor Intel Series: August 2026 CVE Trends

F5 Labs sees automated exploitation of WP2Shell, a WordPress chain that gives unauthenticated attackers admin accounts on 6.9 and 7.0. Patch now.

Armory Castle exploited a BeyondTrust zero-day. Exposed AI hacking dashboards, a CVSS 10 Magento RCE, and WP2Shell hits WordPress.

This emergency release adds two rules to the Cloudflare Free Ruleset to block anomalous request patterns. RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Free Rules...

WP2Shell combines two WordPress Core flaws to move from an unauthenticated request to server-side code execution. It can let an attacker create an administrator account and install a plugin-based web shell. Seqrite’s October 16 analysis lists affected releases, but does not establish widespread live exploitation. The report says the flaws were disclosed in July 2026. The chain matters because it removes the login step. A public site running an affected release may be exposed before an owner sees a suspicious account or plugin. Analysts at Seqrite identified and documented WP2Shell, combining CVE-2026-63030 and CVE-2026-60137 into a route from a public REST API request to code execution. Their technical breakdown of WP2Shell explains the sequence and host artifacts. CVE-2026-63030 affects the REST API batch controller at /wp-json/batch/v1 , which processes several API requests in one submission. Seqrite says nested requests can confuse route handling and reach functionality that should require authentication. This flaw alone does not execute code; it provides a path to the second weakness. CVE-2026-60137 is an SQL injection flaw in the posts endpoint. The public author_exclude parameter maps to author__not_in in WP_Query . WP2Shell Attack According to Seqrite, poorly handled input can affect the database query. Chained with the route flaw, it lets an unauthenticated request reach the vulnerable query. The proof of concept then establishes an administrator-level foothold and remote code execution. In simple terms, SQL injection lets input affect a database query in an unintended way. Here, the first flaw helps an unauthenticated request reach that vulnerable query; the second supplies the database weakness. The chain’s impact comes from how the two issues work together, not from either flaw being described as a direct web shell by itself. Once code runs on the server, an attacker may have a way to make further changes beyond the WordPress dashboard. The demonstrated steps matter to defenders. The chain can create an unexpected administrator account, stage a ZIP archive in uploads, unpack PHP files, and move a plugin directory into wp-content/plugins . Wp2shell Exploit Flow (Source – SEQRITE) The plugin acts as a web shell, an interface for running server commands. Cybersecurity News has covered a separate WordPress account creation vulnerability and recent Comment2Shell vulnerability coverage , where different flaws also lead to account or shell risks. Seqrite describes temporary write checks under wp-content , followed by archive staging in wp-content/uploads/2026/10/ and extraction under wp-content/upgrade/ . Sample archive The sample archive is wp2shell_4e9b3641.zip ; extracted files and plugin folders use a wp2shell_<hex> pattern. The report says httpd.exe may perform file writes, as it can during normal plugin operations. That process name alone is not proof of compromise. More useful signs are the WP2Shell filenames, new PHP files, and unexpected administrators. A WordPress poisoned plugin supply-chain incident also involved a web shell, but used a different delivery method. The report lists WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 as vulnerable to the full chain. Versions 6.8.0–6.8.5 are affected by CVE-2026-60137. It lists 6.8.6, 6.9.5, and 7.0.2 as fixed. Upgrade to the appropriate fixed release or a later supported version, and verify the update completed. Restricting unauthenticated access to sensitive REST API features may reduce exposure where practical, but does not replace patching. After updating, review accounts for unfamiliar administrators, inspect plugin and cache folders for new or changed PHP files, and check logs for suspicious batch-endpoint requests. Look for temp-write-test-* files, wp2shell_*.zip archives, and wp2shell_<hex> plugin folders. If found, preserve evidence, disable suspicious plugins, reset affected credentials, and investigate persistence. A patched version number alone does not prove an earlier compromise has been removed. Indicators of compromise (IoCs):- Type Indicator from source Notes Endpoint /wp-json/batch/v1 REST API batch endpoint File pattern temp-write-test-* Temporary files under wp-content/ Archive example wp2shell_4e9b3641.zip Sample in wp-content/uploads/2026/10/ Directory pattern wp2shell_<hex> Seen under upgrade and plugins directories PHP file pattern wp2shell_<hex>.php Example extracted filename File activity New or changed .php files in plugins or cache folders Compare with expected site activity Account Unexpected administrator Check creation time Detection HTTP/CVE-2026-63030!DP.50405 Quick Heal network detection Detection HTTP/CVE-2026-63030!SP.50370 Quick Heal network detection Detection SL_A WP2Shell Suspicious PHP File Modification in WordPress Plugins Behavioral detection Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs . The post WP2Shell Attack Lets Hackers Create WordPress Admin Accounts and Install Web Shells Without Login appeared first on Cyber Security News .

WP2Shell chains REST API route confusion and SQL injection into unauthenticated RCE on WordPress 6.9 and 7.0, and F5 Labs already sees automated attacks.

I spent a few days building a benchmark that measures 27 models over 7 different cases. My goal was to measure if, given a real Application Security problem, can a model produce a fix that actually works? For instance, can the AI determine whether a blocked HTTP request is a real attack or a false positive? Given a blog post that talks about a new vulnerability (like wp2shell) can it understand the post and create a virtual-patch applying a WAF rule? If an attack like a SQL Injection comes from

2026年7月に公開されたWordPress Coreの重大なエクスプロイトチェーン「WP2Shell」により、認証されていない攻撃者が脆弱なサイト上でコードを実行できる状態になっています。 このチェーンはCVE-2026-63030とCVE-2026-60137という2つの脆弱性を連鎖させ、最終的にウェブシェルとし

WordPress本体の脆弱性「wp2shell」について、Seqriteが2026年10月16日に攻撃挙動を分析。CVE-2026-63030とCVE-2026-60137の影響バージョン、修正版、不審な管理者アカウントやプラグイン、PHPファイルなどの侵害痕跡と調査ポイントを整理

WP2Shell is a critical WordPress Core exploit chain disclosed in July 2026 that can enables pre-authentication remote code execution (RCE) on vulnerable

Seqriteの研究者Amruta Wagh氏の分析によると、WordPressコアに存在する2件の脆弱性を連鎖させることで、認証なしにリモートコードを実行できる可能性があります。Vulnerabilityassessment service 「WP2Shell」と名付けられたこの攻撃チェーンは2026年7月に登場し

WordPressの重大なエクスプロイトチェーン「WP2Shell」が確認されました。REST APIのルート混同とSQLインジェクションを組み合わせることで、認証されていない攻撃者が脆弱なWebサイト上で任意のコードを実行できます。 Seqriteの研究者Amruta Wagh氏は、このチェーンを2026年7月に公

京都教育大学はWordPress本体の脆弱性「wp2shell」（CVE-2026-60137・CVE-2026-63030）を悪用され、学科や附属学校・幼稚園の6サイトが改ざんされたと公表。7月22日に不審アクセスを検知し、9月4日までに復旧。侵入経緯と管理者向け対策を解説