Actively Exploited WordPress Vulnerability and Emerging Cybersecurity Threats Highlighted in SANS StormCast

The July 21, 2026, SANS Internet Storm Center StormCast covered an actively exploited WordPress core vulnerability (CVE-2026-63030) affecting instances with exposed REST APIs, requiring no additional configuration to be vulnerable. Attackers use identifiable user agents (e.g., containing the CVE number or 'WP to shell test') for reconnaissance, including SQL injection checks, before deploying web shells in WordPress’s cache directory—a writable location where PHP execution is permitted. Incident response recommendations include monitoring for new MySQL accounts, inspecting the cache directory for malicious files, and performing a full system rebuild rather than merely removing artifacts. The episode also highlighted Holograph malware, which abuses Microsoft Graph API (via calendar messages) and DNS covert channels for command-and-control, with detection possible through anomalous DNS request patterns. Additionally, self-hosted Gitea software faced recent critical vulnerabilities, emphasizing the need for updates and restricted public exposure. The discussion noted MySQL configuration options to limit file-writing privileges as a potential mitigation for WordPress exploits.