TL;DR
SharePoint Server vulnerability CVE-2026-50522 is under active exploitation to steal machine keys; attackers are chaining WordPress flaws CVE-2026-60137 and CVE-2026-63030 to compromise millions of sites; Palo Alto Networks PAN-OS flaw exploited by Qilin ransomware operators for initial access.
Executive Summary
- Microsoft SharePoint Server CVE-2026-50522 (CVSS 9.8) is under active in-the-wild exploitation with attackers stealing machine keys to maintain persistence beyond patching.
- WordPress critical vulnerabilities CVE-2026-60137 and CVE-2026-63030 are being chained in active attacks to install webshells and malicious plugins across millions of sites.
- Palo Alto Networks PAN-OS authentication bypass vulnerability is being weaponized by Qilin ransomware operators as an initial access vector in targeted intrusions.
- AWS Kiro IDE flaw allows attackers to rewrite configuration and execute code via hidden text on web pages with no user approval required.
- German and U.S. authorities dismantled Kratos phishing-as-a-service platform and arrested its developer in Indonesia.
Top Threats Today
1. SharePoint RCE Actively Exploited for Persistence Beyond Patching
Severity: CRITICAL Affected: Technology
CVE-2026-50522, a critical deserialization flaw in Microsoft SharePoint Server (CVSS 9.8), is under active exploitation [1]. Threat actors are leveraging the vulnerability not only to achieve remote code execution but to steal machine keys, enabling them to maintain unauthorized access even after affected servers are patched [2]. The public availability of a proof-of-concept following Microsoft's July 2026 Patch Tuesday release has accelerated exploitation campaigns [1].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Apply Microsoft's July 2026 SharePoint Server patches immediately if not already deployed.
- Audit SharePoint servers for evidence of machine key theft or RCE activity; review authentication logs for anomalous access patterns.
- Segment SharePoint infrastructure from critical systems to limit lateral movement if compromise is suspected.
- Monitor for indicators of machine key abuse (unexpected certificate usage, cross-server authentication anomalies).
2. WordPress Critical Flaws Chained in Large-Scale Webshell Campaigns
Severity: HIGH Affected: Technology
CVE-2026-60137 and CVE-2026-63030, two critical WordPress Core vulnerabilities collectively referred to as “wp2shell,” are being actively exploited in coordinated attacks [1]. Within three days of public disclosure, attackers began widely chaining these flaws to deploy persistent webshells and install malicious plugins on millions of WordPress ⚠ installations [2]. The attack surface is vast given WordPress's ubiquity as a content management platform [2].
Sources:[1] BleepingComputer[2] Dark Reading
Recommended Action
- Update WordPress Core to the latest patched version immediately across all installations.
- Scan WordPress sites for webshells and unauthorized plugins; remove any suspicious files or code.
- Enable Web Application Firewall (WAF) rules to block exploitation attempts targeting these CVEs.
- Review WordPress user accounts and API tokens for unauthorized access; reset any compromised credentials.
3. Palo Alto Networks PAN-OS Exploited by Qilin Ransomware Operators
Severity: HIGH Affected: Technology
Arctic Wolf Labs investigated multiple intrusions in June 2026 where threat actors exploited a high-severity Palo Alto Networks PAN-OS authentication bypass vulnerability ⚠ as an initial access point to deploy Qilin (also known as Agenda) ransomware [1]. The flaw has since been patched, but its active weaponization by ransomware operators signals heightened risk for organizations running unpatched PAN-OS instances [1].
Sources:[1] The Hacker News
Recommended Action
- Verify that all Palo Alto Networks PAN-OS instances have been updated with the latest security patches.
- Review PAN-OS authentication logs and administrative access records for suspicious activity dating back to June 2026.
- Segment network perimeter infrastructure to limit ransomware propagation if an intrusion is detected.
- Implement network-based detection rules for Qilin ransomware command-and-control communications.
4. AWS Kiro IDE Configuration Rewriting via Poisoned Web Pages
Severity: HIGH Affected: Technology
Researchers at Intezer, in collaboration with Kodem Security, discovered that AWS's Kiro agentic coding IDE can be manipulated by hidden text embedded on a web page to rewrite its own configuration file and execute attacker-controlled code on a developer's machine, with no approval or user confirmation step to halt the attack [1]. The flaw allows attackers to target developers via seemingly benign web content.
Sources:[1] The Hacker News
Recommended Action
- Review AWS Kiro security advisories and apply any patches or configuration hardening steps released by AWS.
- Train developers to be cautious of suspicious web content and to review Kiro configuration changes before accepting them.
- Monitor development machine activity and Kiro logs for unexpected configuration modifications.
5. Kratos Phishing-as-a-Service Platform Dismantled; Developer Arrested
Severity: MEDIUM Affected: Technology
German and U.S. authorities dismantled the central infrastructure of Kratos, a phishing-as-a-service (PhaaS) platform with global reach, resulting in the arrest of its developer in Indonesia [1]. The action disrupts a significant distribution channel for phishing campaigns but highlights the ongoing threat posed by commercialized phishing infrastructure.
Sources:[1] BleepingComputer
Recommended Action
- Review email security logs for phishing campaigns originating from known Kratos infrastructure (post-takedown indicators may be published by law enforcement).
- Maintain heightened vigilance for phishing; threat actors may migrate to alternative PhaaS providers.
- Reinforce employee security awareness training on phishing recognition and reporting.
Today’s Action Checklist
- ☐ URGENT: Patch all Microsoft SharePoint Server instances with July 2026 updates; audit for evidence of machine key theft.
- ☐ URGENT: Update WordPress Core across all sites to the latest version; scan for webshells and unauthorized plugins.
- ☐ HIGH: Verify Palo Alto Networks PAN-OS patches are applied; review authentication logs for June 2026 onwards.
- ☐ HIGH: Review AWS Kiro security advisories and apply recommended hardening or patches.
- ☐ Maintain elevated phishing monitoring and employee awareness following Kratos platform takedown.