Today’s Field Note

Two live fires today, both of the “patching is not the finish line” variety. Microsoft SharePoint CVE-2026-50522 (CVSS 9.8, unauthenticated deserialization RCE, credited to DEVCORE) is being exploited in the wild following a public PoC, and watchTowr confirms attackers are pulling machine keys, which means they keep their access even after you patch. This is the fourth SharePoint bug burned in a month, so treat your servers as suspect, not clean. Meanwhile the wp2shell chain (CVE-2026-63030 and CVE-2026-60137) in WordPress Core is being exploited within hours of the fix dropping, dropping webshells and rogue plugins that outlive the update. In both cases the update stops the bleeding but does nothing about the intruder already inside.

Today’s Action

  • Patch SharePoint against CVE-2026-50522 now, then rotate ASP.NET machine keys and restart IIS. A patch alone leaves stolen keys valid.
  • Hunt SharePoint for unexpected .aspx files, w3wp child processes, and post-exploitation persistence. Assume compromise on any internet-facing instance.
  • Patch WordPress Core against CVE-2026-63030 and CVE-2026-60137, then audit for unknown plugins, modified core files, and dropped webshells.
  • Review outbound traffic and admin account changes on both platforms for signs the intruder already moved.
  • Take internet-facing SharePoint offline until patched and keys rotated if you cannot do it same-day.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Patch the hole, then go find who already walked through it.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.