{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Wordfence Security News","title":"WP2Shell RCE, SonicWall Zero-Days & ServiceNow Exploit | Wordfence Security News #16","html":"<iframe width=\"100%\" height=\"180\" frameborder=\"no\" scrolling=\"no\" seamless src=\"https://share.transistor.fm/e/2bd02a8d\"></iframe>","width":"100%","height":180,"duration":1028,"description":"WP2Shell RCE, SonicWall Zero-Days & ServiceNow Exploit | Wordfence Security News #16\n\nThis week in Wordfence Security News (Week of July 20, 2026):\nWP2Shell chains two WordPress core bugs into unauthenticated RCE on default installs of 6.9 and 7.0; CISA added both flaws to its KEV catalog on July 21.\nAttackers had root on SonicWall SMA 1000 VPN appliances for about three weeks before the July 14 advisory, capturing LDAP credentials off the wire.\nA separate Palo Alto GlobalProtect authentication bypass was the way in for June intrusions that ended in Qilin ransomware.\nA pre-auth ServiceNow AI Platform sandbox escape was exploited three days after its write-up went public; self-hosted and partner-managed instances are at risk.\nCISA added a 2008 Cisco IOS flaw to its KEV catalog as allied agencies warned of an FSB unit copying router configurations over weak SNMP.\nOpenAI says its own models escaped an evaluation sandbox and hacked Hugging Face to grab benchmark answers.\nThe Jscrambler and AsyncAPI npm compromises stole developer secrets in ways that disabling install scripts would not stop.\nTimestamps:\n\n0:00 Introduction\n0:48 WP2Shell WordPress core unauthenticated RCE\n5:38 SonicWall SMA 1000 VPN zero-days\n7:50 ServiceNow AI Platform pre-auth RCE\n9:22 2008 Cisco IOS flaw added to CISA KEV\n11:30 OpenAI models hack Hugging Face\n14:16 AsyncAPI and Jscrambler npm compromises\n\nStory Links:\nPSA: WordPress Core patched unauthenticated RCE vulnerability chain (Wordfence)\nwp2shell aftermath: the first critical unauthenticated WordPress core RCE in nearly a decade (Wordfence)\nWP2Shell exploit technical analysis and real attack data (Wordfence)\nWP2Shell: pre-authentication RCE in WordPress core\nSonicWall SMA 1000 VPN zero-day exploitation\nPalo Alto GlobalProtect bypass leads to Qilin ransomware\nServiceNow AI Platform pre-auth RCE (CVE-2026-6875)\nCISA adds 2008 Cisco IOS flaw to KEV\nJoint advisory on FSB targeting of network devices\nOpenAI on the Hugging Face model evaluation...","thumbnail_url":"https://img.transistorcdn.com/tNZ1BCLBa7hdisGHRggcQKe1fS0BRjNwLU5euMPMXfE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNjZm/M2NiNzczNWQ4MDdh/OTYyMTg5MDQ5ODk3/ODI5ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}