If you host WordPress for clients, check every site's version today. Two WordPress Core bugs chain into remote code execution that needs no login and no plugins, and CISA added both to the Known Exploited Vulnerabilities catalog on July 21. The chain has a name — Tenable calls wp2shell "the name given to two vulnerabilities in WordPress Core" — and the fix is WordPress 7.0.2, 6.9.5, or 6.8.6 depending on your branch.

The two halves do different jobs. CVE-2026-60137 is the SQL injection: per NVD, WordPress "does not properly sanitise the author__not_in parameter of WP_Query." CVE-2026-63030 is the opener — a route-confusion flaw in the REST API batch endpoint at /wp-json/batch/v1, which per Rapid7 "performs validation and execution in separate loops." Together they reach code execution: Rapid7 says the escalation "chains WordPress internals to create an administrator account," after which "the attacker logs in and uploads a malicious plugin for code execution."

Reading either score alone will mislead you. Tenable lists CVE-2026-63030 at CVSS 9.8 and CVE-2026-60137 at CVSS 5.9, WordPress rates the SQL injection Moderate, and NVD carries two base scores for each CVE from different assigners. For triage, use CISA's description of the pair: the SQL injection "can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations." Tenable puts it flatly: "No preconditions exist beyond the default WordPress configuration."

The version math is not uniform, so check each site. Per the 7.0.2 release post, "WordPress 6.9 is affected by both vulnerabilities" and 6.9.5 fixes both; "WordPress 6.8 is only affected by the first vulnerability" and 6.8.6 fixes it. "Versions of WordPress prior to 6.8 are not affected." A 6.8.x site has the SQL injection but not the RCE chain — still worth patching, just not the same fire.

WordPress.org did not wait for site owners to act: "Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions." And the exploit is public — per Rapid7, "Searchlight Cyber has published full technical details of the exploit chain, multiple public proof-of-concept exploits have surfaced, and both CVEs were added to CISA's Known Exploited Vulnerabilities (KEV) catalog on July 21, confirming active exploitation."

CISA gave the RCE half a July 24 due date, three days after the add, and the SQL injection August 4. Both entries cite BOD 26-04, the risk-based directive we covered in #010, whose shortest tier is reserved for bugs that are internet-exposed, on KEV, automatable, and grant total control. A public WordPress site hits all four.

What to do this week:

1. Inventory versions and confirm the update landed. Forced auto-updates miss installs with auto-updates disabled, sites under a managed-host update freeze, and anything on a filesystem the updater cannot write to. Confirm every site you manage reads 7.0.2, 6.9.5, or 6.8.6.
2. Block the batch endpoint where you cannot patch today. Rapid7's temporary mitigation is to "block the /wp-json/batch/v1 endpoint (or ?rest_route=/batch/v1) at a web application firewall, or disable anonymous REST API access using a plugin." That buys time on a site stuck behind a change window.
3. Hunt on anything exposed and unpatched. The payoff is an administrator account and a malicious plugin, so look there: review the user list for admins you did not create, check for unfamiliar plugins, and review HTTP logs for anomalous batch requests. Any internet-reachable site unpatched after July 17 earns that pass.

Advisories

An exploited Check Point bug hands attackers full admin on the management server

If you run Check Point Security Management or Multi-Domain Security Management, patch this week. CVE-2026-16232 (CVSS 9.1) lets an unauthenticated attacker "obtain an application login token and use it to login via SmartConsole with full admin privileges and apply changes to the security policy and security configuration," per advisory sk185169. Check Point "is aware that this vulnerability is being exploited, impacting a very small number of customers." CISA added it to KEV on July 22, due July 25. Remote exploitation needs internet access to the Management Server IP and a Trusted Clients setting that does not restrict access.

Action: install the Jumbo Hotfix Accumulator — Take 36 or later for R82.10, Take 118 for R82, Take 158 for R81.20. Restrict Trusted Clients to specific IPs rather than "Any," and get the management server off any internet-reachable address. Check Point also published five attacker IPs and an audit-log hunt: search the Audit Logs view for "Authentication method: application token." Run it even after patching — the fix will not tell you whether someone got in first.

Both 9.8 SharePoint RCEs from July Patch Tuesday are now on KEV

The two SharePoint deserialization bugs we flagged in #014 as not exploited have both since been added to KEV. CVE-2026-58644 landed July 16 (due July 19) and CVE-2026-50522 followed July 22 (due July 25). NVD rates both CVSS 9.8: "deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network" (CWE-502).

Action: if you deferred the July SharePoint cumulative update, stop deferring — it closes both, plus the exploited missing-auth bug from #014. Confirm the build per farm, then check any internet-reachable SharePoint that ran unpatched past July 16 for web shells and unfamiliar admin activity.

Two unauthenticated FortiSandbox command injections join KEV

CISA added CVE-2026-25089 and CVE-2026-39808 to KEV on July 16 (due July 19). Both are OS command injection flaws (CWE-78) in FortiSandbox that let an unauthenticated attacker run commands via crafted HTTP requests — FG-IR-26-141 in the web UI, FG-IR-26-100 through an API endpoint. Fortinet rates both Critical at CVSSv3 9.1; NVD carries them at 9.8. Both PSIRT pages still show "Known Exploited: No," so the vendor flag is not the field to triage on this week.

Action: upgrade FortiSandbox 5.0.0–5.0.5 to 5.0.6 or above and 4.4.0–4.4.8 to 4.4.9 or above; Cloud and PaaS 5.0.4–5.0.5 also go to 5.0.6. Per Fortinet, the 5.2 branch is not affected. If the web UI or API is reachable from anything but your management network, fix that alongside the upgrade.

A Langflow RCE published as a 0-day in January is now exploited

CVE-2026-0770 in Langflow, the low-code tool for building LLM workflows, hit KEV on July 21 with a July 24 due date. ZDI rates it CVSS 9.8: a flaw "within the handling of the exec_globals parameter provided to the validate endpoint" where "authentication is not required" and the attacker executes "code in the context of root." ZDI reported it in July 2025 and published it as a 0-day in January 2026 after the disclosure window ran out.

Action: CISA's KEV entry points at the Langflow v1.9.0 release as its remediation reference, so bring installs to 1.9.0 or later. Regardless of version, take Langflow off the public internet, and check whether anyone on your team or a client's stood an instance up for a proof of concept.

A UPnP bug in DD-WRT is feeding a DDoS botnet

CISA added CVE-2021-27137 in DD-WRT router firmware to KEV on July 21 (due July 24). NVD rates it CVSS 8.1 and traces it to "an unsafe strcpy in the UPnP handling functionality." The precondition matters: exploitation "requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default)." BleepingComputer reports a Gafgyt variant called C0XMO exploiting it, with 19 DDoS flood methods and a habit of deleting competing botnets' binaries and persistence.

Action: DD-WRT rarely appears in a managed fleet, but it shows up in branch offices, home-office kit, and inherited networks. Update to build 45724 or later and turn UPnP off unless something needs it. If a device ran UPnP on a WAN-facing interface, reflash rather than clean it.

Product changes

Purview DLP and auto-labeling extend to non-Microsoft SaaS apps

Per roadmap item 568075, Purview DLP and auto-labeling "now extend to non-Microsoft connected apps (e.g., Google Workspace, Box, Dropbox, Salesforce, ServiceNow, Amazon Web Services, and Cisco Webex)." Preview began July 2026, with general availability listed for September 2026. Microsoft notes that "the conditions and actions supported for each of these applications vary."

Action: if you have clients on E5 or a Purview add-on who also live in Salesforce or Google Workspace, test this in a preview tenant before the September GA. Map which conditions and actions each connector supports before you promise a client coverage; Microsoft says support varies by app.

App and agent installation settings will apply across both admin centers

Per roadmap item 567883, installation changes made in either console will be "consistently enforced across Teams, Outlook, and Microsoft 365 Copilot." Previously, M365 admin center changes "only applied to Outlook and Microsoft 365, while changes made in the Teams admin center only applied to Teams." General availability is listed for August 2026.

Action: before the August rollout, reconcile the two consoles for each tenant you manage. If your Teams app policy blocks something the M365 admin center allows — or the reverse — unification resolves that split in one direction, and you want to know which before users do.

Purview auto-labeling capacity goes from 100,000 to 500,000 files per day

Per roadmap item 567890, Microsoft is "increasing the maximum auto-labeling capacity for SharePoint and OneDrive from 100,000 up to 500,000 files per tenant per day," with general availability listed for August 2026.

Action: if you paused an auto-labeling backfill because it would have taken months at the old ceiling, requeue it after the August rollout. Re-test your label policy against a sample first — a higher ceiling also means a misconfigured rule mislabels five times as fast.

Field notes

An npm supply-chain compromise ran at import time, not install time

Microsoft documented a compromise of the AsyncAPI npm packages that breaks a common assumption. Five malicious versions across four packages — @asyncapi/specs 6.11.2-alpha.1 and 6.11.2, @asyncapi/generator 3.3.1, @asyncapi/generator-components 0.7.1, and @asyncapi/generator-helpers 1.1.1 — were published starting July 14. The payload "executes at module-load (import/require) time," not through install hooks, and the framework "targets over 100 environment variable names" — GITHUB_TOKEN, NPM_TOKEN, AWS_ACCESS_KEY among them — plus credential files on disk including .npmrc, .aws/credentials, kubeconfig, and id_rsa/id_ed25519. The entry point was a GitHub Actions workflow that "used pull_request_target" while checking out untrusted pull-request code, exposing a bot token.

Action: Microsoft is explicit that the usual guard does not apply: "do not rely on npm install --ignore-scripts as a mitigation; this campaign executes when the module is imported." Remove all five versions, purge npm and Yarn caches, block outbound traffic to 85.137.53[.]71 on ports 8080, 8081, and 8091, and rotate credentials from a clean host if any build agent imported a bad version. If you run CI for clients, audit your own workflows for pull_request_target paired with a checkout of PR head.

ACR Stealer arrives through ClickFix prompts and living-off-the-land binaries

Microsoft analyzed two intrusion chains for ACR Stealer, an infostealer reportedly offered as a service and "associated with the rebranding of Amatera Stealer." Both start the same way: a ClickFix prompt reached "through malvertising or SEO-manipulated search results" that talks the user into pasting and running a command. One chain uses rundll32.exe to load a DLL from a remote WebDAV share over HTTPS; the other spawns MSHTA to fetch remote HTA content. Once resident, it "invokes Windows Data Protection API (DPAPI) routines to decrypt locally stored browser passwords" and sweeps the disk for PDFs and Microsoft 365 documents.

Action: the choke points are the user pasting a command and the binary that runs it. Microsoft's guidance covers both: teach users to treat "ClickFix-style prompts, fake verification checks, and paste-and-run instructions as malicious," and "use application control and attack surface reduction rules to restrict PowerShell, Python, mshta.exe, rundll32.exe, and similar tools from launching untrusted or internet-delivered content." Since the payoff is browser credentials and session tokens, treat a confirmed infection as a credential incident: reset passwords and revoke sessions, not just reimage.