Chinese-Speaking Threat Actor Exploits WordPress Flaws in Global Cyber Campaign A suspected Chinese-speaking threat actor has compromised at least 49 organizations across 29 countries by exploiting vulnerabilities in WordPress installations. The campaign, tracked via CVE-2026-63030 and CVE-2026-60137, demonstrates how a single compromised website can serve as a launchpad for database theft, credential abuse, and deeper network intrusion. The attack began on July 22, 2026, when the threat actor deployed a custom webshell using the wp2shell exploit chain. After gaining access, the attackers dumped the WordPress user table, stealing 13 administrator accounts, and created a hidden admin account (kapibala2) disguised as a legitimate user. A custom plugin was used to enumerate the installation, while the webshell facilitated reconnaissance, command execution, and credential harvesting. The threat actor then searched readable files for database credentials, enabling password-spraying attacks against internal SQL servers. In one case involving a Western government agency, 18,566 records including plaintext passwords and personally identifiable information (PII) linked to law enforcement and government entities were exfiltrated. Stolen data was staged in a ZIP archive before being downloaded, with follow-up password-spraying attempts continuing for hours. Beyond WordPress, the same actor targeted ZyXEL GS1900 switches, compromising or exfiltrating data from 996 devices across 48 countries. GreyNoise, which uncovered the campaign through attacker infrastructure monitoring and decoy systems, linked the activity to broader scans of network appliances, Linux systems, and business applications, indicating a multi-vector, opportunistic approach. The incident underscores the risks of unpatched WordPress vulnerabilities, which can escalate from public-facing website exposure to enterprise-wide compromise. The threat actor’s tactics included disabling security tools, enumerating services, and exploiting weak database configurations, while their rapidly evolving code suggests possible large language model (LLM) assistance, though no specific AI tool was identified. Indicators of Compromise (IoCs) include: - Backdoor hashes: `0e81d80b40eaacbf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f`, `0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6`, `2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1` - C2 infrastructure: `*.981666[.]xyz`, `74.48.66[.]73`, `104.225.153[.]141`, `172.245.247[.]21` - Threat actor accounts: `kapibala2`, `kapibala` The report withholds details on the affected government organization and some infrastructure due to victim sensitivity and operational security concerns. The case highlights how web application breaches can rapidly escalate into severe data security incidents with far-reaching consequences.

Cisco Patches High-Severity Privilege Escalation Flaws in IOS XR Software Cisco has released high-severity software updates to address two critical privilege escalation vulnerabilities in its IOS XR Software, which could allow authenticated, local attackers to gain root-level access or full administrative control over affected devices. Given the role of these routers in enterprise networks, the flaws pose a significant security risk. ### Vulnerability Details Both vulnerabilities are rated High severity (CVSS 8.8/10) and can be exploited independently: 1. CVE-2026-20040 – A CLI privilege escalation flaw caused by improper validation of user-supplied arguments in certain commands. A low-privileged attacker could execute arbitrary commands as root on the underlying OS. 2. CVE-2026-20046 – A CLI privilege escalation issue in Cisco IOS XRv 9000 Routers, stemming from incorrect command-to-task-group mapping. Attackers could bypass security checks to perform unauthorized administrative actions. Cisco confirmed that IOS, IOS XE, and NX-OS Software are not affected by these flaws. ### Mitigation & Patching Cisco urges administrators to upgrade to fixed software versions (e.g., 25.2.21, 25.4.2) or apply Software Maintenance Updates (SMUs). For CVE-2026-20040, patching is mandatory, as no workarounds exist. For CVE-2026-20046, organizations using TACACS+ AAA command authorization can restrict unauthorized command access as a temporary measure. Systems running older versions (25.1 or earlier, 25.3 branch) are particularly vulnerable and should migrate to patched releases immediately.