Issue 89 reported wp2shell as patched with no confirmed exploitation. That changed Saturday. By early Sunday morning UTC, watchTowr principal researcher Jake Knott confirmed that active exploitation was underway, with attackers initially using public exploit code to extract hashed WordPress credentials via the SQL injection component before progressing to remote code execution once additional technical details became public. KEVIntel telemetry identified 13 distinct IP addresses from Switzerland, Germany, the UK, Indonesia, Lithuania, the Netherlands, and Singapore conducting attacks. Wiz observed multiple actors abusing the REST API batch endpoint against cloud-hosted WordPress deployments, with post-exploitation activity including malicious plugin uploads for persistent backdoors and administrator account enumeration. Hexastrike confirmed it assisted with incident response on several active compromises over the weekend, and the WP-SHELLSTORM crew, which this brief covered in Issue 85 as part of the global CMS webshell campaign, has been identified among actors actively exploiting the vulnerability. The attack chain typically extracts password hashes via the SQL injection, cracks an administrator password offline, and then uses those credentials to upload a malicious plugin or directly write a webshell to the server. A separate and more direct attack path to unauthenticated code execution without requiring a cracked password has also been documented in circulating proof-of-concept code.

Hugging Face published a disclosure on July 16 describing an intrusion it says was carried out end to end by an autonomous AI agent system. The attack began with a malicious dataset uploaded to the platform that exploited two code-execution paths in Hugging Face's data processing pipeline: a remote code execution path in its dataset loader and a template injection in a dataset configuration file. Both paths allowed code to run on a processing worker that handled the dataset. From that foothold, the agent escalated to node-level access, harvested cloud provider credentials and Kubernetes cluster credentials, and moved laterally into several internal clusters over a weekend, executing more than 17,000 individual actions through a swarm of short-lived sandboxed environments. The agent used a self-migrating command-and-control infrastructure staged on third-party platforms to maintain persistence and coordination across its sandboxed instances. Hugging Face's security team detected the intrusion and used AI of its own to dissect the attack, concluding that the attacker used an unknown large language model. The company confirmed no public models, datasets, Spaces, container images, or published software packages were tampered with. Internal datasets and service credentials were accessed. Hugging Face has blocked the two code-execution paths, evicted the attacker from affected clusters, rebuilt compromised nodes, and rotated affected credentials. It is asking all users to rotate their access tokens as a precaution.

Security researchers confirmed today that PAN-OS vulnerabilities from Palo Alto's July 8 advisory batch are being exploited by initial access brokers to gain footholds in corporate networks, which are then sold to Qilin ransomware affiliates for deployment. Multiple intrusions have been documented with the same pattern: PAN-OS as the initial entry vector, lateral movement through the internal network, and Qilin ransomware deployed to encrypt file servers and backup systems. The July 8 batch included 13 vulnerabilities covering PAN-OS and Prisma Access, led by CVE-2026-0288, an unauthenticated buffer overflow in the PAN-OS User-ID Terminal Server Agent rated at highest urgency. Issue 83 covered the advisory on July 10 and noted that no active exploitation had been confirmed at that point. That has changed. Palo Alto has not yet confirmed which specific CVE from the July 8 batch is the primary entry vector, but the exploitation pattern described by researchers matches the appliances and features covered by the advisory. The Qilin group has been active throughout 2026 and previously targeted healthcare organizations using VMware ESXi vulnerabilities.