WordPress Releases Security Update Fixing Two Vulnerabilities That Chain to Remote Code Execution
The WordPress development team has published a security release including WordPress 7.0.2 on July 17, 2026, to address multiple vulnerabilities that could lead to remote code execution when chained together.
The update resolves two specific issues tracked as CVE-2026-63030 and CVE-2026-60137. Security researchers determined that combining these flaws allows an attacker to execute arbitrary code remotely on vulnerable sites.
CVE-2026-60137 is an input validation weakness affecting certain functions. It can result in SQL injection when the application processes untrusted data supplied by plugins or themes.
CVE-2026-63030 arises from route interpretation confusion within the REST API batch endpoint. When exploited in conjunction with the SQL injection vulnerability, it enables remote code execution.
The CVE-2026-60137 issue affects the 6.8 branch and later, while CVE-2026-63030 exists in the 6.9 branch and later. Chained attacks are not possible on the 6.8 series according to the advisory.
Site administrators are strongly encouraged to update their installations without delay to protect against potential exploitation.
Related articles
CISA Adds Cisco Secure Firewall and GitLab Flaws to Known Exploited Vulnerabilities Catalog
US authorities have warned that two vulnerabilities in Cisco Systems firewall products and the GitLab development platform are being actively exploited in the wild. The Cybersecurity and Infrastructure Security Agency added CVE-2026-76418 and CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29, 2026, urging immediate remediation. CVE-2026-76418 affects Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, allowing unauthenticated attackers to trigger device reboots and cause denial-of-service conditions. CVE-2026-97229 is an integer overflow in GitLab stemming from insufficient validation of regular expressions in CI/CD configurations, enabling remote code execution without authentication. CISA noted that the GitLab issue originates from a dependency in Ruby/Onigmo and may impact other products beyond GitLab itself. Organizations are advised to apply patches or mitigations without delay to prevent further exploitation.
Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild
Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.
Critical Pre-Auth RCE Vulnerability CVE-2026-118633 Affects All Sophos UTM Versions, Manual Patch Required After EOL
Sophos has disclosed a critical remote code execution vulnerability in its legacy Sophos UTM security gateway product. The flaw, tracked as CVE-2026-118633, carries a CVSSv4.0 base score of 9.2 and is rated Critical. It allows unauthenticated attackers to execute arbitrary commands as root by triggering a race condition through repeated attacks against the email proxy when scanning is enabled. Although the product reached end-of-life, Sophos released a manual patch that users must apply themselves because automatic updates are no longer available. The company urges immediate patching for any deployments still using the email protection feature and recommends migration to the supported Sophos Firewall. The issue was reported through Sophos’s bug bounty program by an external researcher.
PHP2Shell Campaign Chains PHP and Linux Kernel Flaws to Compromise 25 Servers Including US Government-Linked Network
Israeli security firm Dream disclosed a sophisticated campaign that achieved root access on 25 servers by chaining two remote code execution vulnerabilities in PHP2Shell with a Linux kernel flaw. The attackers targeted 24 perimeter firewalls from a single unnamed vendor plus one internal management server across the United States, Japan, Taiwan, and South Korea. Three of the compromised devices belonged to an environment connected to the US government, where the intrusion led to domain controller access and Active Directory enumeration. The attack chain began with CVE-2026-109618 and CVE-2026-109619, which granted initial web server access, and escalated via CVE-2026-46300 (Fragnesia) to obtain root privileges. Dream observed extensive reconnaissance using the Chinese search engine FOFA, with indicators pointing to Chinese-language tooling and timing, though no specific threat actor was attributed.