Hybrid Cloud
Cybersecurity
Data & AI
IoT & Connectivity
Industry
Health
Banking and Finance
Public Sector
Retail
Tourism and Leisure
Transport & Logistics
Energy & Utilities
Smart Cities
Cybersecurity Weekly Briefing, 18-24 julio
Wp2shell: Unauthenticated RCE in the WordPress core
Researchers at Searchlight Cyber have identified Wp2shell, a critical unauthenticated remote code execution vulnerability in the WordPress core, published as CVE-2026-63030 (CVSSv3 7.5 according to CISA, but 9.8 according to WPScan).
The flaw can be exploited via the REST API’s batch endpoint and does not require a valid account or user interaction, potentially leading to the complete compromise of the site. Cloudflare confirmed that the vulnerable code path is accessible when a persistent object cache is not in use. It affects versions 6.9.0–6.9.4 and 7.0.0–7.0.1, which have been fixed in versions 6.9.5 and 7.0.2. Given that WordPress is the world’s most widely deployed content management system, the potential impact is enormous, even without any confirmed active exploitation. It is highly likely that a public proof-of-concept will be released shortly, as the open-source code is easily analysable.
It is recommended that you update urgently, as WordPress has forced automatic updates on installations where this option is enabled, and that you manually check every site exposed to the internet.
Active exploitation of the CVE-2026-0257 vulnerability in Palo Alto to deploy Qilin
Researchers at Arctic Wolf have linked multiple intrusions detected in June 2026 to the exploitation of CVE-2026-02577 (CVSSv3 9.1), an authentication bypass flaw in PAN-OS GlobalProtect portals and gateways affecting branches 12.1, 11.2, 11.1 and 10.2, as well as Prisma Access.
The attacker gains an unauthenticated VPN session when certain credential bypass cookies are enabled, allowing them to move from the perimeter to the entire Windows domain. Following initial access, a recurring operational pattern is observed: exfiltration of credentials from LSASS and Active Directory using comsvcs.dll and ntdsutil; lateral movement via PsExec; deployment of remote access tools such as AnyDesk or Ngrok; systematic deletion of event logs; and, finally, encryption with the Qilin ransomware, with prior exfiltration to MEGA or Rclone in cases of double extortion.
It is recommended to apply the vendor’s patch immediately, close any active GlobalProtect sessions after patching, and monitor for anomalous processes in C:\PerfLogs\.
CISA expands its alert on attacks by Iranian actors against OT technology
CISA, the FBI and the EPA have expanded an alert issued in April regarding attacks on operational technology (OT) exposed to the internet by actors affiliated with the Iranian regime. The initial warning focused on programmable logic controllers (PLCs) from Rockwell Automation and Allen-Bradley, whilst this week’s update extends the scope to include additional manufacturers, including Siemens and Schneider Electric, both of which have a significant presence in critical energy, water and manufacturing infrastructure worldwide.
The incidents observed include the tampering of project files and interference with human-machine interface (HMI) screens and SCADA systems, with affected organisations having suffered operational disruptions and financial losses. Formally attributing these attacks to Iran is complex because the regime sometimes uses ransomware groups or other organisations as a front.
OT operators are advised to restrict their PLCs’ direct internet access and urgently strengthen network segmentation, regardless of the manufacturer used.
Cloning of Microsoft login portals to hijack sessions belonging to EU and UN organisations
Researchers at Infoblox have detailed an active adversary-in-the-middle (AiTM) phishing campaign that clones Microsoft authentication pages to intercept credentials, MFA codes and session tokens in real time. The campaign has been active since at least May 2026, targeting universities, companies and multinational organisations, including European Union and United Nations agencies such as the European Investment Bank.
The entry vector consists of phishing emails sent from already compromised corporate email accounts, using lures relating to tenders and confidential documentation which, after bypassing a CAPTCHA or Cloudflare Turnstile, redirect recipients to a reverse proxy that relays the victim’s credentials and MFA data in real time to legitimate Microsoft servers whilst intercepting the resulting session cookies and OAuth tokens.
As authentication is completed natively on Microsoft’s actual servers, conditional access policies recognise a valid login whilst the token is silently exfiltrated, granting persistent access to the tenant without the need to crack passwords or compromise the MFA infrastructure. The group rotates between various Phishing-as-a-Service kits (EvilProxy, FlowerStorm/Storm-1167 and Kali365) and reuses old compromised domains to preserve their historical reputation.
It is recommended to prioritise phishing-resistant FIDO2/WebAuthn hardware keys and to monitor for anomalous logins following clicks on email links.
ConsentFix allows Microsoft 365 accounts to be hijacked without stealing credentials
Kaspersky has analysed a new variant of the ClickFix technique, known as ConsentFix, which allows Microsoft 365 accounts to be compromised through social engineering and abuse of the OAuth protocol. Rather than capturing passwords, attackers trick the victim into dragging an identifier from the browser’s address bar onto a malicious page, thereby unwittingly handing over a valid OAuth token.
With this access, they can compromise Outlook, Teams, SharePoint and OneDrive, launch internal Business Email Compromise (BEC) campaigns and access corporate documents without needing to bypass multi-factor authentication.
The availability of public guides and tools for carrying out these attacks significantly lowers the barrier to entry for new cybercriminals, making it advisable to strengthen user training and email security.
◾ This newsletter is one of the deliverables of our Operational and Strategic Intelligence service. If you are interested in knowing the rest of the Operational and Strategic Intelligence contents included in the service, please contact us →
