The Week's Threat Landscape
Small inputs, massive consequences. This week's security roundup covers pre-authenticated code execution in WordPress, two SonicWall zero-days already being exploited in the wild, a critical Microsoft SharePoint deserialization flaw, and a botnet actively hunting exposed AI services. The throughline: attackers are finding simple paths through exposed systems, weak input handling, and old drivers.
WordPress Pre-Authenticated RCE
Two chained vulnerabilities — CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection) — combine to deliver pre-authenticated remote code execution on WordPress. No plugins required.
Proof-of-concept exploits are already circulating, and early in-the-wild exploitation has been observed. With hundreds of millions of WordPress installations globally, the blast radius is enormous.
Action required: Update to the latest WordPress version immediately. If automatic updates are disabled, enable them.
SonicWall SMA 1000 Zero-Days
Two zero-days in SonicWall Secure Mobile Access appliances were actively exploited weeks before public disclosure:
| CVE | CVSS | Impact |
|---|---|---|
| CVE-2026-15409 | 10.0 | Arbitrary command execution |
| CVE-2026-15410 | 7.2 | Secondary escalation path |
Threat actor UTA0533 has been exploiting these since June 22, 2026. Affected hardware: SonicWall SMA 1000 series VPN appliances.
Action required: Apply patches immediately. Review VPN appliance logs for signs of activity predating the patch window.
Microsoft SharePoint Deserialization (CVE-2026-58644)
A CVSS 9.8 deserialization vulnerability in Microsoft SharePoint was confirmed as a zero-day in active exploitation. Patches shipped as part of July 14's Patch Tuesday — the largest on record, addressing 622 total vulnerabilities.
U.S. federal agencies were given until July 19, 2026 to patch this one. That deadline has now passed.
Action required: Verify SharePoint patches from the July 2026 cumulative update have been applied.
NadMesh Botnet Targets Exposed AI Services
A new botnet is scanning for and exploiting publicly exposed AI services:
- ComfyUI (image generation UI)
- Ollama (local LLM runner)
- n8n (workflow automation)
- Open WebUI, Langflow, Gradio
Once access is gained, NadMesh steals AWS keys and Kubernetes tokens, establishes persistence via SSH backdoors, and installs cron-based watchdogs to maintain access after reboots.
Action required: Never expose AI service management UIs to the public internet. Use authentication, firewalls, or VPN access.
OpenSSL DoS — "HollowByte"
A crafted 11-byte input forces OpenSSL servers to allocate 128 KB of heap memory, enabling denial-of-service at scale. The vulnerability, nicknamed HollowByte, is patched in:
- OpenSSL 4.0.1
- OpenSSL 3.6.3
- OpenSSL 3.5.7
- OpenSSL 3.4.6
- OpenSSL 3.0.21
Additional Notable Items
OkoBot Cryptocurrency Stealer
OkoBot targets cryptocurrency wallet software — Trezor Suite, Ledger Live, MetaMask, and others. Capabilities include seed phrase capture, keylogging, and screenshot exfiltration. Detections span 25+ countries.
Ransomware Q2 2026
Two groups dominate the quarter:
- "The Gentlemen" — 300 confirmed victims
- Qilin — 289 confirmed victims
EDR-killing tools are now available on illicit markets for as little as $2,000, lowering the barrier to evading endpoint detection.
Kudankulam Nuclear Power Plant Exposure
Data from India's Kudankulam Nuclear Power Plant was exposed following a ransomware incident at Reliance Infrastructure, a contractor. The extent of nuclear-related data in the exposed set has not been disclosed.
Apple App Store Gambling Apps
Over 60 apps disguising themselves as legitimate software were discovered in the Apple App Store, targeting Brazilian users with covert gambling functionality.
Priority Patch Order
- WordPress core — pre-auth RCE, PoC in wild
- SonicWall SMA 1000 — exploited since June 22
- SharePoint — federal deadline already passed
- OpenSSL — patch before internet-facing services become DoS targets
Small attack surfaces, large consequences. This week is a reminder that pre-auth vulnerabilities and exposed management interfaces remain among the highest-value targets for opportunistic attackers.