Weekly Security Briefing: WordPress RCE, SonicWall Zero-Day Vulnerability, AI Service Attacks, and More Threats

Event Overview

This week (July 13–19, 2026) saw a severe security posture, with multiple high-risk vulnerabilities disclosed or exploited in the wild. A chain of vulnerabilities (CVE-2026-63030 and CVE-2026-60137) in the WordPress core could lead to remote code execution (RCE), requiring no authentication or plugins to attack. Two zero-day vulnerabilities (CVE-2026-15409, CVE-2026-15410) in SonicWall SMA 1000 series VPN devices were exploited by an unknown threat actor, UTA0533, before June 22. A SharePoint Server RCE zero-day (CVE-2026-58644) has been added by CISA to the Known Exploited Vulnerabilities Catalog. Additionally, OpenSSL has a denial-of-service vulnerability named HollowByte that can exhaust server memory with just 11 bytes of data.

In terms of malware, the OkoBot framework spreads through ClickFix and disguised legitimate software, stealing cryptocurrency wallet seed phrases; the NadMesh botnet, written in Go, scans exposed AI services (such as ComfyUI, Ollama, n8n, etc.) to steal AWS keys and Kubernetes tokens. Microsoft's July Patch Tuesday fixed a total of 622 vulnerabilities, setting a new historical record.

Technical and Risk Analysis

Attack Methods and Exploitation Chains 1.### Attack Methods and Exploit Chains 1. WordPress wp2shell (CVE-2026-63030 + CVE-2026-60137): Attackers can anonymously send specially crafted requests, exploiting REST API batch routing confusion and SQL injection to chain-trigger RCE. PoC has been published; watchTowr reports signs of exploitation in the wild. 2. SonicWall SMA Zero-Day (CVE-2026-15409, CVE-2026-15410): Threat actor UTA0533 exploited these two vulnerabilities before patches were released, achieving remote command execution via custom malware and gaining full control of devices. Volexity's investigation found that the group used multiple zero-day exploits and dedicated backdoors. 3. SharePoint RCE (CVE-2026-58644): A deserialization vulnerability allowing unauthenticated attackers to execute arbitrary code. Microsoft fixed it in the July 14 patch and confirmed in-the-wild exploitation. 4. OpenSSL HollowByte (affects versions prior to 4.0.1, etc.): 11 bytes of malicious data cause the server to allocate 128KB of heap memory that is never freed, leading to resource exhaustion. Discovered and reported by Okta Red Team. 5. OkoBot: The infection chain lures users into executing malware hosted on GitHub. After installing the framework, it injects browser extensions (Rilide) and wallet processes (Trezor Suite, Ledger Live), capturing screenshots, logging keystrokes, and stealing clipboard contents. 6. NadMesh: Automatically scans exposed AI services, exploits known vulnerabilities or weak configurations, implants persistence mechanisms (SSH keys, hidden files, cron watchdogs), and steals cloud credentials and model data.

Affected Assets - Web Applications: WordPress sites (hundreds of millions globally), SharePoint servers, AI platforms (ComfyUI, Ollama, etc.). - Network Devices: SonicWall SMA VPN devices, potentially affecting remote access security. - Identity and Credentials: OkoBot targets cryptocurrency wallets; NadMesh steals cloud keys; OpenSSL affects all services using the affected versions. - Endpoints: Windows systems infected via OkoBot.### Enterprise Impact Analysis - Operational Risk: WordPress and SharePoint vulnerabilities may lead to website tampering, data leakage, or backdoor persistence; compromised VPN devices can allow lateral movement within the internal network. - Financial Risk: Leaked cryptocurrency wallet seeds directly cause asset loss; exposed cloud keys may lead to resource abuse and billing loss. - Compliance Risk: Failure to patch critical vulnerabilities in a timely manner may violate data protection requirements such as PCI-DSS and GDPR; CISA's remediation deadlines for FCEB agencies are mandatory. - Brand Risk: Website breaches can erode user trust; service outages (e.g., OpenSSL DoS) cause business disruption. - Data Risk: Exposed AI services may leak training data or internal knowledge bases.

Industry Trend Observations

• This week's events reveal several long-term trends:
• AI Tools as a Double-Edged Sword: Both vulnerability discovery and exploitation are aided by AI, enabling attackers to quickly weaponize flaws; at the same time, AI services become new attack surfaces (e.g., NadMesh targeting AI infrastructure).
• Zero-Day Exploitation Becoming Routine: SonicWall and SharePoint zero-days were exploited before patches were released, with attackers developing targeted exploits.
• Supply Chain and Open Source Risks: Vulnerabilities in widely used open-source components like WordPress and OpenSSL have far-reaching impacts; new vulnerabilities also emerged in 7-Zip, RabbitMQ, etc.
• Cryptocurrency Threats Becoming Specialized: The OkoBot framework contains over 20 payloads, forming a modular malware ecosystem.
• Patching Speed Challenges: The surge in vulnerabilities (e.g., 622 from Microsoft) strains enterprise patching capabilities, making automated patching and risk prioritization critical.

These are not isolated incidents, but the inevitable result of attackers upgrading their techniques and expanding attack surfaces. Enterprises must treat security as an ongoing process, not a one-time fix.

Defense and Response Recommendations

Enterprise Level 1. Patch Known Vulnerabilities Immediately: Prioritize patching WordPress, SharePoint, and SonicWall SMA devices; cross-reference with the CISA KEV catalog. 2. Strengthen Authentication: Enable multi-factor authentication (MFA) for WordPress and SharePoint; restrict API access. 3. Zero Trust Architecture: Apply least privilege to VPN devices, monitor anomalous traffic; deploy network isolation for AI services.

Technical Level - Endpoint Detection and Response (EDR): Deploy EDR to monitor anomalous processes (e.g., OkoBot injection behavior).### Technical Level - Endpoint Detection and Response (EDR): Deploy EDR to monitor abnormal processes (e.g., OkoBot injection behavior). - Threat Intelligence: Subscribe to CISA and vendor security bulletins, integrate IOCs (e.g., NadMesh's C2 domains, SSH key fingerprints). - Cloud Security: Audit cloud credential usage, enable AWS IAM role temporary tokens, scan Kubernetes cluster permissions. - Vulnerability Management: Use automated tools to patch WordPress plugins and core; upgrade OpenSSL to 4.0.1 or above.

Management Level - Incident Response Drills: Conduct tabletop exercises for WordPress RCE and VPN compromise scenarios. - Third-Party Risk Management: Assess the patching capabilities of managed WordPress providers; review third-party software sources on GitHub. - Security Governance: Incorporate CISA KEV into compliance checks, ensure SharePoint patching is completed by July 19.

SecurityPost Insight

This week’s dense vulnerabilities and attacks indicate that the threats faced by enterprises have shifted from single weaknesses to multi-vector combined attacks. The WordPress RCE chained vulnerability once again proves that even a basic application can cause devastating consequences if the attack chain is complete. SonicWall zero-day is seen as an "entry ticket" for nation-state attackers, while AI services are becoming a new paradise for cloud credential theft.

• Key Takeaways:
• Patching Speed Determines Survival: The exploitation window for zero-days is drastically shortening; enterprises must establish 24/7 vulnerability monitoring and emergency patching processes.
• Attack Surface Expands to AI Pipelines: No longer just web and VPN, AI orchestration tools and open interfaces are becoming high-value targets and must be included in asset inventories.
• Threat Intelligence Integration: No single security product can defend alone; EDR, cloud security, identity, and threat intelligence must be integrated for coordinated defense.

Future Trends to Watch: AI-driven automated attacks, trust crisis in open-source components, modularization of cryptocurrency malware. Enterprise decision-makers should shift security investments from "prevention" to "detection and response," and cultivate emergency response capabilities for new attack patterns.