HollowByte: 11-byte payload triggers OpenSSL memory DoS

Sat, 18 Jul 2026 11:51:11 +0000

Engineer — Plan: OpenSSL is universally deployed across Linux servers, TLS termination points, and containers, so exposure is near-universal; however, no KEV listing, EPSS score, or public PoC is present, meaning no active exploitation pressure. Track the OpenSSL patch release and schedule deployment within your normal critical-patch window.
SOC/IR — Skip
Leader — Skip

WordPress Core wp2shell Flaw Enables Unauthenticated RCE

Sat, 18 Jul 2026 11:51:11 +0000

Engineer — Act: Public PoC is available for an unauthenticated RCE in WordPress core affecting 6.9 and 7.0 with no plugins required — patch every WordPress instance to the fixed version immediately and audit web server file systems for newly dropped shells or unexpected PHP files.
SOC/IR — Act: A public PoC for unauthenticated RCE in WordPress core means active exploitation is likely underway; sweep web access logs for anomalous POST patterns against wp-admin and wp-includes endpoints, and hunt for new or modified PHP files and unexpected child processes spawned by the web server process since the disclosure date.
Leader — Act: Unauthenticated RCE in WordPress core with a working public exploit is a systemic exposure for any org running WordPress-powered properties; confirm inventory of WordPress versions across customer-facing and internal sites, verify engineering has prioritized emergency patching, and assess whether key SaaS or media vendors in your supply chain are exposed.