23 techniques observed across 4 entries, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)
Initial Access TA0001
T1091Replication Through Removable Media×1
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components.
T1059.001Command and Scripting Interpreter: PowerShell×2
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
T1059.005Command and Scripting Interpreter: Visual Basic×1
Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.
An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.
T1204.004User Execution: Malicious Copy and Paste×2
An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions (such as prompts to fix errors or complete CAPTCHAs) that instead instruct the user to copy and paste malicious code.
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
T1027.011Obfuscated Files or Information: Fileless Storage×1
Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository. Shared memory directories on Linux systems (`/dev/shm`, `/run/shm`, `/var/run`, and `/var/lock`) and volatile directories on Network Devices (`/tmp` and `/volatile`) may also be considered fileless storage, as files written to these directories are mapped directly to RAM and not stored on the disk..
T1036.004Masquerading: Masquerade Task or Service×1
Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description. Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.
Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.
T1552.001Unsecured Credentials: Credentials In Files×1
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
T1555.003Credentials from Password Stores: Credentials from Web Browsers×1
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.
T1071.001Application Layer Protocol: Web Protocols×1
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.
active-threatsSOCRadar finds a webshell-brokerage crew's own open staging server, 5,700+ live shells, 27 weaponized CVEs, and a parallel Nacos/Spring Boot credential heist
Where this entity is cited
active-threats2
trending-vulnerabilities2
Source distribution
euvd.enisa.europa.eu2 (9%)
slcyber.io2 (9%)
thehackernews.com2 (9%)
wordpress.org2 (9%)
advisories.ncsc.nl1 (5%)
blog.calif.io1 (5%)
cisa.gov1 (5%)
copy.fail1 (5%)
other10 (45%)
Co-occurring entities
Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.
Check Point Research published its analysis of StopAndProtect on 2026-08-18, an operation it had been tracking since it "first noticed a ransomware family called StopAndProtect in the middle of May 2026" (Check Point Research, 2026-08-18). The name originally applied only to the encryption component and was extended to the whole operation because encryption is not the universal outcome; many victims are only quietly mined for data. The structural point, and the reason this matters to organisations that are not themselves targets, is where the operation lives: payload hosting, command-and-control and stolen-data collection all run on compromised WordPress sites rather than on infrastructure the operators own.
The persistence mechanism is the part worth acting on, because it is chosen specifically to defeat the review an administrator would actually perform. Check Point recovered an installer from one hijacked server which, on activation, writes a must-use plugin to wp-content/mu-plugins/wp-sec.php. Files in that directory load automatically on every request, and (the property that matters) "They do not appear/manage like normal plugins in the standard Plugins UI" (Check Point Research, 2026-08-18). The planted plugin registers a hidden REST route, wp-sec/v1/upload; "It authenticates with hardcoded credentials" and "It lets anyone who knows valid credentials upload files to almost any path under the WordPress root", explicitly including .php files (Check Point Research, 2026-08-18). The installer then deactivates and deletes itself. What remains is a file in a directory nobody browses, reachable by anyone holding a static credential, that will write executable code anywhere on the site.
Delivery to end users is the now-familiar paste-and-run pattern: a fake verification page on a hijacked site logs the visitor and puts a PowerShell command on the clipboard for the victim to run themselves, and Check Point records that "the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command" (Check Point Research, 2026-08-18). Two PowerShell stages lead to a base64-encoded .NET assembly that is decoded and loaded in memory, and each .NET stage reaches the next by reflectively enumerating the loaded assembly's types for a static, parameterless method of a fixed name and invoking it, a generic in-memory hand-off repeated at every stage, so nothing after the first command touches disk as an executable. The final component set covers encryption (with per-file keys derived from a password and machine-name pair the operator embeds in the renamed file), an SMB and removable-media worm, a Visual Basic script spreader that moves laterally by creating processes remotely through Windows management interfaces, a lock screen carrying the ransom note, a collector that keylogs, lists files, harvests messaging contacts through interface automation and screenshots the desktop at half-minute intervals while the victim is active, and a bespoke victim-to-operator chat utility.
The scale estimate comes from the operators' own mistake. Check Point assesses that the operator infected their own machine and uploaded desktop files to the collection server, which yielded the source of a fleet-management tool used to toggle the lure across the estate, and "It also contains a few text files listing close to 2,000 compromised WordPress domains, giving us a hint about the size of the operation" (Check Point Research, 2026-08-18). A separate exposed directory held roughly 700 stolen-data archives and about 31,000 victim screenshots gathered between mid-May and the end of July 2026. Log analysis as of 24 July 2026 indicates more than 6,000 unique victim addresses, distributed most heavily across the United States and then Russia and India in a table Check Point publishes; the lab qualifies this as partial, noting sandbox and researcher traffic in the data and that one server's log had been reset more than once.
On how the WordPress sites themselves were taken, Check Point makes no claim beyond an observation that "There are many vulnerable WordPress websites simply because their owners do not keep them updated" (Check Point Research, 2026-08-18), illustrated by one compromised site found running a five-year-old WordPress core with around forty identifiable issues. No CVE, no credential-theft finding, no actor name and no lineage to any previously tracked operation are offered, and none is asserted here.
We first noticed a ransomware family called StopAndProtect in the middle of May 2026.
It authenticates with hardcoded credentials.
It lets anyone who knows valid credentials upload files to almost any path under the WordPress root.
They do not appear/manage like normal plugins in the standard Plugins UI.
There are many vulnerable WordPress websites simply because their owners do not keep them updated.
It also contains a few text files listing close to 2,000 compromised WordPress domains, giving us a hint about the size of the operation.
WordPress shipped an out-of-band core security release on 2026-07-17 fixing a pre-authentication remote-code-execution chain that researcher Adam Kues of Searchlight Cyber calls WP2Shell (WordPress.org, 2026-07-17; Searchlight Cyber, 2026-07-17). The chain's first half, CVE-2026-63030, is a route-confusion weakness (CWE-436) in the REST API batch endpoint (/wp-json/batch/v1, also reachable as ?rest_route=/batch/v1) which processes several sub-requests in one call; a parsing quirk desynchronizes internal request arrays so one sub-request executes under another's handler. Chained with CVE-2026-60137 (an SQL injection in the author__not_in parameter of WP_Query, the class that builds most WordPress database queries) it yields code execution with no authentication, no plugins and no special configuration: "the attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins" (Searchlight Cyber, 2026-07-17). The full chain affects 6.9.0–6.9.4 and 7.0.0–7.0.1; the SQL-injection component reaches back into 6.8.x, where it is exposed when a plugin or theme passes untrusted input to the parameter (ENISA EUVD, 2026-07-17). Scoring is contested between assigners: the WPScan CNA rates the RCE component 9.8 and the SQLi 5.9, while the CISA-ADP secondary assessment carried by NVD and EUVD inverts the pair at 7.5 and 9.1 (ENISA EUVD, 2026-07-18).
Searchlight Cyber withheld exploit mechanics "to give defenders time to patch" and instead published a checker tool; VulnCheck's independent analysis describes the practical post-exploitation route as dumping credential hashes via the SQL injection, cracking or reusing an administrator login, and dropping a webshell through the admin interface (VulnCheck, 2026-07-17). Public proof-of-concept code is already on GitHub; The Hacker News reports "a working proof-of-concept has gone up on GitHub" (The Hacker News, 2026-07-17), while an earlier-observed public repository carried only detection-grade probing (time-based blind SQL-injection and route-confusion checks); either way, exploit tooling is public. Exploitation status as of publication: Rapid7 was "not aware of publicly confirmed in-the-wild exploitation" as of 2026-07-17 evening (Rapid7, 2026-07-17), the CVE pair is not in CISA KEV, and a circulated secondhand exploitation claim traces back to a Patchstack database page that in fact makes only the predictive statement "this vulnerability is highly dangerous and expected to become exploited." NCSC-NL's advisory rates likelihood high and expects short-term exploitation, recommending WAF-blocking of the batch endpoint where patching must wait (NCSC-NL, 2026-07-18).
The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins.
Hexastrike started seeing exploitation attempts in its honeypots over the weekend, and on Sunday the company said it had already assisted with incident response in several attacks.
Dabei verwenden Cyberkriminelle eine Kombination aus zwei Schwachstellen in WordPress
Unternehmen und Betreiberinnen kritischer Infrastrukturen, welche nicht im Fintech-Bereich tätig sind, sollten ausgehende Verbindungen zu RPC-Anbietern einschränken.
wp2shell drops you inside the PHP interpreter, and on a hardened host that interpreter is locked down. Dangerous functions like system() and exec() are switched off with disable_functions, the filesystem can be mounted read-only, and there may be nowhere to write a file.
The first recovers the native system handler and calls it directly, in native code, even though disable_functions took away the PHP-level name.
The su file on disk is never modified, so file-integrity monitoring that watches file contents or writes to the binary sees nothing.
Searchlight Cyber's Adam Kues tasked OpenAI's GPT5.6 model (running autonomously for up to 10 hours per session) to independently rediscover and weaponise "WP2Shell", the WordPress core pre-authentication RCE chain this pipeline covered on 2026-07-18 (CVE-2026-63030, a REST batch-endpoint route-confusion flaw, chained with CVE-2026-60137, an SQL injection in WP_Query's author__not_in parameter; both patched out of band in WordPress 7.0.2/6.9.5/6.8.6 on 2026-07-17). Without human guidance beyond the initial task, the model recursively chained batch API requests to bypass method validation, poisoned the request cache with fabricated posts, abused the oEmbed subsystem to insert database rows, and replayed a request with elevated administrator context via the parse_request hook, ending with an unauthorised admin account on a stock, plugin-free install (Searchlight Cyber, 2026-07-20). Kues put the cost at roughly $25, "50% of weekly usage ... ~ $25 USD" on a $200 subscription, and states plainly that "no security researcher could have found and completed this exploit chain in 10 hours without AI." Infosecurity Magazine corroborates (Infosecurity Magazine, 2026-07-20).
Nothing about the CVEs, affected versions or patch guidance has changed; this is a capability finding, not a new vulnerability.
The exploitation status of the WP2Shell chain has flipped. First coverage recorded a public checker, public proof-of-concept code and an NCSC-NL assessment that exploitation was expected shortly, but no confirmed in-the-wild activity. That is no longer the case: "both CVEs were added to CISA's Known Exploited Vulnerabilities (KEV) catalog on July 21" (Rapid7, 2026-07-22). Rapid7 updated its analysis the same day to state that "Given confirmed exploitation in the wild, Rapid7 strongly recommends investigating for signs of compromise" (Rapid7, 2026-07-22). Exploitation was observable earlier than the KEV date: Hexastrike "started seeing exploitation attempts in its honeypots over the weekend, and on Sunday the company said it had already assisted with incident response in several attacks", and watchTowr independently reported in-the-wild attempts (SecurityWeek, 2026-07-20).
Nothing about the vulnerable component, the prerequisites or the patched versions has changed; the affected branches remain 6.9.0–6.9.4 and 7.0.0–7.0.1, fixed in 6.9.5 and 7.0.2 respectively (Rapid7, 2026-07-22). What changes is the defender's posture. A chain that reaches pre-authentication code execution on a stock installation, against a platform this widely deployed across public-sector web estates, and that was being exploited within roughly 48 hours of the out-of-band release, leaves a real window in which an internet-reachable instance could have been taken over before its administrator patched. Patching closes the entry route; it does not remove a webshell, an attacker-created administrator account, or a scheduled task planted beforehand.
Triage: requests to the REST batch endpoint are a legitimate WordPress feature, so their presence alone is not the signal; what distinguishes exploitation from normal use is unauthenticated batch requests arriving from unfamiliar source ranges in tight bursts, immediately followed by a PHP file appearing under the webroot, a new administrator-role user, or an outbound connection from the web-server process. In web-server access telemetry, correlate on the sequence rather than the endpoint. Post-compromise, the higher-signal artefacts are administrator accounts created after 2026-07-17, unexpected entries in the scheduled-event table, and PHP files whose modification time postdates the release but which are not part of the shipped core distribution.
The original entry's framing was wrong in the direction that understates the finding, and the weekly strategic entry for W30 inherited it. The correction was found by this pipeline's own weekly quality audit re-reading the cited primary.
What Searchlight Cyber's Adam Kues actually ran was a discovery test, not a reconstruction test. The prompt handed to GPT5.6 Sol Ultra opens "This is a test of your ability to discover zero-days" and then closes off the shortcut explicitly: "Do not attempt to use changelogs, git history, or the internet to 'diff' the code against a patched version." Kues explains the reasoning in his own voice (for novel vulnerability discovery, letting a model look at change history is a waste of tokens) and adds a second guard against a failure mode he names directly: models sometimes cheat to achieve what you ask, "either by choosing extremely unlikely configuration options or by fabricating preconditions that aren’t achievable by an attacker" (Searchlight Cyber, 2026-07-20). The model was told a pre-auth-to-RCE chain existed in the repository and asked to find it from first principles, which is a directed hunt with a known-positive, but it is a hunt for something not yet public, not a rebuild of something already published.
The disclosure timeline settles it. Searchlight "held off on publishing this issue to give defenders a chance to upgrade their WordPress instances over the weekend", and during that hold two other parties independently reproduced the full chain before proof-of-concept code surfaced on GitHub. A researcher does not delay publication of a rediscovery of an already-patched bug to protect defenders; the delay only makes sense because the disclosure came first and the patch was the response to it. This pipeline's 2026-07-18 entry on the WP2Shell chain reached the same conclusion from the other direction, recording Searchlight Cyber as the discoverer of CVE-2026-63030 and CVE-2026-60137 and noting the out-of-band WordPress release of 2026-07-17, so the store already carried the correct attribution one entry earlier and then contradicted itself three days later.
Triage: nothing here is an alertable behaviour; this is a correction to a capability assessment. The WP2Shell chain itself remains covered by this pipeline's 2026-07-18 disclosure entry and its 2026-07-26 confirmed-exploitation and KEV update, which carry the exploitation detail, the affected version boundaries and the compromise-assessment guidance; that guidance is unchanged by this correction.
Switzerland's national cyber authority has attached its own jurisdiction's numbers to the WordPress chain this pipeline recorded reaching CISA KEV in July. In an advisory published 2026-08-07, BACS reports a rising count of compromised websites presenting fake CAPTCHAs that push visitors into executing a command themselves, puts the worldwide population of compromised sites at more than 100,000, and states it is currently seeing an increase in the number of Swiss websites being compromised and used to distribute malware (NCSC-CH, 2026-08-07).
The entry point is the already-covered one, now with reporting behind it: BACS writes that in recent days it has received an accumulation of reports from Swiss website operators and web-hosting providers describing exploitation of two recently disclosed WordPress vulnerabilities, and that "criminals use a combination of two vulnerabilities in WordPress" known as WP2Shell, CVE-2026-63030 and CVE-2026-60137 (NCSC-CH, 2026-08-07). Most of the compromised sites run WordPress.
What is new below the entry point is the delivery chain. Once a visitor follows the instruction and runs the command, it fetches further malicious code whose storage and distribution sit on a public blockchain (the technique BACS names EtherHiding) retrieved through the web interfaces of RPC providers that broker access to those networks; the payload is typically an infostealer, with Vidar named as an example, going after credentials, payment-card data and cryptocurrency wallets (NCSC-CH, 2026-08-07). That hop is why the authority's recommendation is an egress-policy one rather than a filtering one: a blockchain read has no domain to sinkhole.
Triage: the client-side execution has a distinctive shape in process-creation telemetry with parent lineage, a command interpreter (powershell.exe on Windows, the terminal shell on macOS) started from a browser process tree, immediately followed by outbound HTTP to an RPC-provider endpoint. Neither half is individually rare on a developer or administrator workstation; the sequence, on a general-office endpoint, is the signal, and the browser parentage is what separates it from legitimate admin scripting, which is not launched from a browser. On the server side, the compromise signature is the WP2Shell request pattern against the unauthenticated REST batch endpoint in web-server access logs, followed by administrator-account or plugin and theme file changes that no admin action accounts for.
The WP2Shell WordPress chain that NCSC-CH named as the entry point for compromised Swiss websites serving fake-CAPTCHA lures now has a published, fully documented route from where it stops to native root. Calif's wp2root write-up of 2026-08-05 is the delta (Calif, 2026-08-05); the original entry stands unchanged.
The premise is the hardened-host case defenders actually rely on. As the researcher puts it, "wp2shell drops you inside the PHP interpreter, and on a hardened host that interpreter is locked down. Dangerous functions like system() and exec() are switched off with disable_functions, the filesystem can be mounted read-only, and there may be nowhere to write a file." wp2root's contribution is that none of those three controls holds.
Escaping PHP uses a use-after-free on the legacy Serializable interface path, where recursive unserialize() calls inside a Serializable::unserialize() body share the outer parser's reference table and a later property-table resize frees a bucket the outer parser still holds. The resulting arbitrary read builds a chain that locates the PHP binary and its gadgets in the live process rather than relying on hardcoded offsets, and then (this is the part that matters for anyone treating disable_functions as a boundary) "recovers the native system handler and calls it directly, in native code, even though disable_functions took away the PHP-level name." The setting removes a name, not the underlying handler. The alternative path launches a position-independent stager that creates an anonymous in-memory file, pins it on a file descriptor that survives execve, and executes it without anything reaching disk.
The root step is where this stops being a research curiosity. It is CVE-2026-31431, "Copy Fail", a logic flaw reachable through the kernel's AF_ALG crypto socket interface and splice() that lets an unprivileged local user overwrite the page-cache copy of a setuid-root binary with a small write. Running that binary then executes the attacker's cached stub as root. Its discloser is explicit about the defensive consequence: "The su file on disk is never modified, so file-integrity monitoring that watches file contents or writes to the binary sees nothing." The same page records that "The same 732-byte Python script roots every Linux distribution shipped since 2017" (Xint Code, 2026-04-29).
The fact that changes the risk calculation, and that neither the original coverage nor the queue note carried: CVE-2026-31431 has been on CISA's Known Exploited Vulnerabilities catalogue since 2026-05-01, listed as a Linux Kernel incorrect-resource-transfer flaw allowing privilege escalation, entirely independent of this chain-building exercise (CISA, catalog version 2026.08.07); the kernel's own CVE announcement records the flaw (Linux kernel CVE team, 2026-04-22). The kernel half of wp2root is not a proof of concept; it is a bug attackers are already using, now documented as the root step for a WordPress compromise path with confirmed exploitation against this constituency's own web estate.
Detection, telemetry class first. On the PHP side the discriminating signal is a web-server worker process spawning a child whose executable resolves to an anonymous memory-backed file rather than a normal on-disk binary; legitimate PHP application workflows do not create processes that way, which makes it low-noise. For the kernel step, any process holding an AF_ALG socket is itself unusual: the mainstream consumers of kernel crypto, including disk encryption, kernel TLS and IPsec, use the in-kernel API and never touch AF_ALG. Triage: a setuid-root binary executing is ordinary on every Linux host, so that event alone is noise; the composite that is not ordinary is an AF_ALG socket opened and closed by a web-application process, followed shortly by a setuid binary running under that same process tree.
WordPress shipped 7.0.3 on 2026-08-06 fixing CVE-2026-64638, a pre-authentication reflected cross-site scripting flaw on the login screen that the vendor says carries "potential to lead to PHP code execution" (WordPress.org, 2026-08-06). The advisory lists 24 separate affected-and-patched branch ranges, from 4.7.0–4.7.33 up to 7.0.0–7.0.2, which is the practical scope statement for anyone maintaining an estate of sites on pinned branches (WordPress, 2026-08-07).
The root cause is a disagreement between two sanitisers about the same bytes. A failed-login error message runs the submitted username through wp_strip_all_tags(), which wraps PHP's strip_tags() and only recognises a tag when the angle bracket is immediately followed by a letter; the message later reaches wp_kses_post(), WordPress's own tokenizer, which tolerates whitespace between the bracket and the tag name and renders it as a live element (pwn.ai, 2026-08-06). The login page therefore ends up carrying real, attacker-specified DOM nodes that the first function had already certified as inert text. From there the chain is a sequence of legitimate mechanisms used in order: a clobbered ajaxurl global redirects a script's own request to a same-origin REST route; the REST JSONP callback pattern permits property-chain traversal, so the callback names a method on the opener window and clicks the Application-Password authorization button inside a genuinely logged-in administrator's session; the minted credential then uploads a plugin ZIP, which WordPress extracts into the plugins directory with the nonce and capability checks both passing correctly. The researcher's point is that the extracted PHP is reachable by URL without the plugin ever being activated.
The precondition is worth stating precisely, because it sets the priority: WordPress records that escalation "requires successful social engineering of and explicit interaction by the target victim"; an administrator has to open the attacker's page while logged in. The reflected XSS underneath needs no authentication at all. No party reports exploitation, the flaw was reported on 2026-07-27 and patched on 2026-08-06, and a bounty was paid.
This is not the WP2Shell chain this pipeline tracks as actively exploited against Swiss websites. That chain is CVE-2026-63030 with CVE-2026-60137, found by a different team through a REST batch route confusion into pre-authentication SQL injection; the shared "2Shell" branding is coincidence, not a common root cause. Estates that patched for WP2Shell are not covered for this.
Detection, telemetry class first. The discriminating artifact for delivery sits in web and application access logs: a login POST whose username parameter contains an angle bracket followed by whitespace, since that exact sequence is what defeats one sanitiser while surviving the other, and no legitimate username contains it. Downstream, the escalation signature is an Application Password creation event immediately after an authorization-page view with no prior credential-management activity in the session, followed by a plugin upload from the same session. Where REST audit logging exists, requests carrying a JSONP callback parameter are a low-noise hunt query because ordinary WordPress clients rarely use one. Triage: the injected elements are themselves on the allowlist, so their presence in a rendered admin notice is not anomalous on its own; the discriminator is that they originate from the login error path, an unauthenticated pre-session context, rather than from authenticated content editing.
Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai.
Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim.