PHP2SHELL is so easy to exploit remotely, that all my WAF bypasses are dupes, and I am out of trial reports 🫡
LiveOverflow 🔴 hextree.io @LiveOverflowHere is the time the WAF buys you
9523024.9K
Posts with #wp2shell
#wp2shell
Public posts on X that use #wp2shell.
Related hashtags
- "On October 25, [...] a AI-assisted campaign that rooted 25 servers [with php2shell], including systems in a US government-affiliated environment."
34838.9K 
The exploit has now been public on GitHub for several hours, and WordPress has a built-in automatic update mechanism, so we have released our #wp2shell lab. It includes a safe environment to reproduce the issue, more details on the vulnerability and exploit, and indicators of compromise for defenders.48507.1K
National CERT/CC@CERT_UG#PatchAlert: wp2shell is being actively exploited. Pre-auth RCE in WordPress Core, no plugins, no login needed. Update to 7.0.2 or 6.9.5 immediately. Full breakdown by Elastic Security Labs below. #CyberSafeUG #wp2shell #WordPressElastic Security Labs @elasticseclabswp2shell PoCs went public within hours of disclosure, and we are seeing active exploitation. Pre-auth RCE in WordPress Core. No plugins required. CVE-2026-63030 and CVE-2026-60137. We ran the Icex0 PoC end-to-end with Elastic Defend. On the host, every run ends the same way. The web server writes PHP under wp-content/plugins/, then spawns a shell. 4 rules caught it: - Payload Execution by Web Server: EDR, kills the shell on launch - PHP File Creation in WordPress Plugin Directory: catches the drop before execution - Suspicious Command Execution via Web Server: flags discovery commands from the web parent - Unusual Command Execution via Web Server: alerts on command lines the host has never run The PoC self-cleans after running. A missing plugin folder doesn't mean a clean host. Patch to 7.0.2 or 6.9.5. Hunt the IOCs while tooling is still stock. Full rule walkthrough, process lineage, and Attack Discovery correlation:035234
wp2shell PoCs went public within hours of disclosure, and we are seeing active exploitation. Pre-auth RCE in WordPress Core. No plugins required. CVE-2026-63030 and CVE-2026-60137. We ran the Icex0 PoC end-to-end with Elastic Defend. On the host, every run ends the same way. The web server writes PHP under wp-content/plugins/, then spawns a shell. 4 rules caught it: - Payload Execution by Web Server: EDR, kills the shell on launch - PHP File Creation in WordPress Plugin Directory: catches the drop before execution - Suspicious Command Execution via Web Server: flags discovery commands from the web parent - Unusual Command Execution via Web Server: alerts on command lines the host has never run The PoC self-cleans after running. A missing plugin folder doesn't mean a clean host. Patch to 7.0.2 or 6.9.5. Hunt the IOCs while tooling is still stock. Full rule walkthrough, process lineage, and Attack Discovery correlation:
121714.9K
Javier Casares@JavierCasares#WordPress #wp2shell: desde el CVE hasta el exploit público 72 horas entre el parche y el exploit funcional. Eso es lo que teníamos para actualizar los sitios de clientes (y propios) que gestionamos, como mi propio blog.135329
check my work on this, but if you own wordpress site that's vulnerable to #wp2shell, and have a working shell, with permission to modify the wordpress instance: find / -type f -name wp-config.php 2>/dev/null | while read -r cfg; do d=$(dirname "$cfg"); echo "updating $d"; (cd "$d" && wp core update --skip-plugins --skip-themes && wp core update-db --skip-plugins --skip-themes); done363410.5K- I hear some people think me saying that #Php2shell isn’t going to end the world is because of skills issues! I guess no one can read this… because we all died from the vulnerability apocalypse! /S 😜😜😜😜😜😜😜😜64232.2K
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday.114315914.8K
We are observing active exploitation using publicly available #wp2shell PoCs. In current telemetry, web and PHP runtimes (httpd, apache2, php-fpm) are spawning shells and executing commands such as "sh -c id", indicating successful command execution. Elastic Endpoint and SIEM detect this behavior through existing rules including: • Payload Execution by Web Server • Suspicious Command Execution via Web Server • Unusual Command Execution via Web Server • PHP File Creation in WordPress Plugin Directory Additional artifacts we are observing include execution from working directories such as: /𝘷𝘢𝘳/𝘸𝘸𝘸/𝘩𝘵𝘮𝘭/<𝘳𝘦𝘥𝘢𝘤𝘵𝘦𝘥>/𝘸𝘦𝘣/𝘸𝘱-𝘤𝘰𝘯𝘵𝘦𝘯𝘵/𝘱𝘭𝘶𝘨𝘪𝘯𝘴/𝘸𝘱2𝘴𝘩𝘦𝘭𝘭_𝘦𝘤499𝘦𝘥𝘤 Some IOCs for unmodified public PoCs (obviously don't rely on those; they are changed very easily): wp-content/plugins/wp2shell_<hex> POST /?rest_route=/batch/v1 User-Agent: wp2shell Links to detections in replies. #WP2Shell #ElasticSecurityLabs #WordPress #ThreatDetection #CyberSecurity17103.7K
The Hacker News@TheHackersNews🛑 ALERT - WordPress sites are under active attack. Attackers are exploiting the #wp2shell chain to gain unauthenticated RCE on vulnerable stock installations, with no plugins required. Public exploit code is now fueling mass scanning and web shell deployments. Read what defenders should check:
1514244665.6K- The Hacker News@TheHackersNews⚡ UPDATE: #wp2shell now has two CVEs, and a working proof-of-concept is public. > CVE-2026-63030 breaks REST batch routing > CVE-2026-60137 injects SQL Chained, they give an anonymous attacker code execution on affected WordPress sites.The Hacker News @TheHackersNews🛑 URGENT - A single anonymous HTTP request can run code on an unpatched #WordPress 6.9 or 7.0 site, even on a default install with zero plugins. The new wp2shell flaw sits in core and still has no CVE for scanners to match. Affected releases and mitigations 🠖57323859.7K
- The Hacker News@TheHackersNews🛑 URGENT - A single anonymous HTTP request can run code on an unpatched #WordPress 6.9 or 7.0 site, even on a default install with zero plugins. The new wp2shell flaw sits in core and still has no CVE for scanners to match. Affected releases and mitigations 🠖
22205685409K 
I've not done any deep dives on bugs in a while so here's a walkthrough of where the #wp2shell bug exists in code, constructing a PoC and highlighting the signs to search for if you're seeing exploitation in the wild. #blueteam #vulnerabilityresearch113505.7K
🔴URGENT - Public PoC released for #wp2shell Chaining two Vulnerabilities (CVE-2026-63030 + CVE-2026-60137), Patch now!!Cyber Security News @The_Cyber_News🚨 New wp2shell RCE Vulnerability Hits Millions of WordPress Sites, Emergency Patch Released Source: A critical pre-authentication remote code execution (RCE) vulnerability dubbed "wp2shell" has been discovered in WordPress Core, putting an estimated 500 million+ websites at risk of full takeover by unauthenticated attackers. The flaw, which stems from a REST API batch-route confusion issue that leads to SQL injection and, ultimately, remote code execution. What makes this bug especially dangerous is that it requires no preconditions and can be exploited by a completely anonymous, unauthenticated user against a stock WordPress installation with zero plugins installed. #cybersecuritynews23614819.1K- 🚨 New wp2shell RCE Vulnerability Hits Millions of WordPress Sites, Emergency Patch Released Source: A critical pre-authentication remote code execution (RCE) vulnerability dubbed "wp2shell" has been discovered in WordPress Core, putting an estimated 500 million+ websites at risk of full takeover by unauthenticated attackers. The flaw, which stems from a REST API batch-route confusion issue that leads to SQL injection and, ultimately, remote code execution. What makes this bug especially dangerous is that it requires no preconditions and can be exploited by a completely anonymous, unauthenticated user against a stock WordPress installation with zero plugins installed. #cybersecuritynews
77824339.1K 
Weeks ago when #WP2Shell dropped and OpenAI Sol Ultra took most of the credit - all I thought about was how all the other labs and AI-pentest companies will rush to prove they can find something in the WordPress core too. Well, today, 3 weeks later - we have the next WordPress core version release with not one, but 12 vulnerabilities being patched. And as expected, the issues have been reported by @AnthropicAI , @pwn_ai , @AikidoSecurity and others. The nastiest one is a login screen XSS, which via some social engineering could lead to Remote Code Execution. Luckily, WordPress is auto-updating fast and none of the vulnerabilities are mass-exploitable like WP2Shell was. As always, @patchstackapp customers received mitigation rules right at the disclosure.07301.8K
Today we're introducing our first upgrade since going live Opsec Workflows: a fleet of autonomous agents that defends your code against attacking agent swarms. Exploit complexity used to be a security control, and AI has mostly removed it. Attackers now run agents in parallel while defense still works one ticket at a time. Describe a security job once in plain English, and Workflows builds the agents behind it and runs them every time the trigger fires. The fleet checks every repo at once, the moment the work shows up, instead of waiting for someone to be online. Your team stops chasing breadth and spends its time on the calls that need judgment. It's live on80811142.6K- @RunOpsecPHP2Shell showed the gap. Two PHP flaws more than a decade old became working exploits in hours, and attack traffic was already hitting sites before the official disclosure. Defense that waits for someone to be online loses that race. A fleet checks every repo at once, the moment a CVE lands.31643371
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress8252.6K
Our demo shows PHP2Shell giving a shell on MediaWiki, Symfony, Laravel, and phpBB. We’ve confirmed exploits work on pre-patch releases of PHP 8.2–8.5. If you haven’t updated, assume attackers can compromise your server, and that exploitation will only get easier.Dan Guido @dguidoUpdate: Our PHP exploit is now production-grade. * stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load * ARM64 + x86-64 targets * MediaWiki, WordPress, phpBB, Laravel * Apache/mod_php and nginx/php-fpm -> root145328839.4K
php2shell is exploitable, the easy path needs display_errors=On. We found zero live customer hosts with it. Under default config, the leak takes heap control down to the freelist. Blog: Demo: #OffensiveSecurity #PraetorianGuard
014353.6K
🚨 #wp2shell — Cross-Platform RAT Deployment via Zero-Credential WordPress Exploit (CVE-2026-63030 + CVE-2026-60137). → "agent_linux_amd64": 9c285fe3a491ee6a6f872ae71d47dfe29e44a40b9e7fcba85a39a2368584333a ("D:/BIN_Research/Knowledge/Defense-Evasion/go-agent-tcp/main.go") [+]
54421020.3K- Show more posts
