Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
A critical WordPress RCE vulnerability (wp2shell) chains REST API confusion and SQL injection to allow unauthenticated code execution, with early signs of in-the-wild exploitation. SonicWall SMA 1000 series devices are being targeted by threat actor UTA0533 using zero-day exploits (CVE-2026-15409/15410) prior to public disclosure. OpenSSL suffers from a severe DoS flaw (HollowByte) where an 11-byte payload causes disproportionate memory allocation, leading to server exhaustion. Microsoft SharePo
Analysis
TL;DR
- A critical WordPress RCE vulnerability (wp2shell) chains REST API confusion and SQL injection to allow unauthenticated code execution, with early signs of in-the-wild exploitation.
- SonicWall SMA 1000 series devices are being targeted by threat actor UTA0533 using zero-day exploits (CVE-2026-15409/15410) prior to public disclosure.
- OpenSSL suffers from a severe DoS flaw (HollowByte) where an 11-byte payload causes disproportionate memory allocation, leading to server exhaustion.
- Microsoft SharePoint Server contains a critical deserialization RCE (CVE-2026-58644) actively exploited in the wild, added to CISA’s KEV catalog.
- OkoBot malware framework targets cryptocurrency users with over 20 payloads, focusing on stealing seed phrases from hardware wallet software via process injection.
Why It Matters
This week highlights a dangerous trend of rapid exploitation of critical infrastructure and widely deployed software, emphasizing the narrow window between vulnerability disclosure and active in-the-wild attacks. The involvement of AI-assisted tooling in surfacing vulnerabilities and the sophistication of multi-stage malware frameworks like OkoBot demonstrate that defenders must prioritize immediate patching and robust monitoring over reactive measures.
Technical Details
- WordPress RCE (wp2shell): Combines CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection) to achieve unauthenticated remote code execution on standard installations without plugins.
- SonicWall Zero-Days: CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) allow arbitrary command execution on SMA 1000 series appliances; exploited by UTA0533 before patches were released.
- OpenSSL HollowByte: A DoS flaw allowing unauthenticated attackers to force heap memory allocation (up to 128 KB) with just 11 bytes, bypassing security handshakes; fixed in versions 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21.
- SharePoint RCE: CVE-2026-58644 (CVSS 9.8) involves deserialization of untrusted data, enabling arbitrary code execution; patched during a record-breaking Patch Tuesday addressing 622 vulnerabilities.
- OkoBot Malware: Uses SSH tunnels to orchestrate 20+ payloads, including ClickFix initial access, Rilide browser stealer, and OkoSpyware for injecting into Ledger/Trezor processes to steal crypto seed phrases.
Industry Insight
Organizations must treat zero-day exploits for critical infrastructure (like SonicWall and SharePoint) as immediate emergencies, prioritizing patching within hours rather than days. The emergence of AI-assisted vulnerability discovery suggests attackers will increasingly leverage automated tools to find and chain flaws, necessitating enhanced automated detection and response capabilities. Additionally, the sophistication of OkoBot indicates that financial and crypto-related sectors require specialized endpoint protection focused on process injection and memory integrity monitoring.
Disclaimer: The above content is generated by AI and is for reference only.