Today’s Field Note

Two things worth your attention before lunch. First, public exploits for the WordPress Core “wp2shell” RCE chain are now circulating, which means the window between “critical advisory” and “mass scanning” has already closed. WordPress runs a nontrivial slice of the internet, so assume automated exploitation against unpatched Core installs is already in motion. Second, 7-Zip shipped 26.02 to fix an RCE triggered by opening a crafted archive, the kind of bug that pairs nicely with a phishing lure and a curious user. Neither is exotic, both are the sort of thing that turns into an incident because someone deferred a patch.

Today’s Action

  • Patch WordPress Core immediately to the fixed release across every site you run, including the forgotten staging and marketing installs.
  • Hunt for “wp2shell” indicators now: unexpected PHP files in web roots, new admin users, and outbound connections from web hosts.
  • Push 7-Zip 26.02 to all endpoints and build systems, and check for the older versions bundled inside other software.
  • Remind users not to open archives from untrusted senders, and detonate suspicious ones in a sandbox instead.
  • Review web-facing logs for the scanning uptick that follows any public PoC release.

Patch the WordPress boxes first. The scanners already found them.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.