Skip to dossier
← fruition.net
just verified
The Perimeter · Issue 08-07-2026

WordPress RCE chain hits KEV as npm supply chain, WP plugin backdoor, and Cisco FMC land same week

This week's dossier is dominated by two things: a WordPress core RCE chain (CVE-2026-60137 + CVE-2026-63030) that CISA added to KEV alongside evidence of a working WP2Shell exploit against unpatched sites, and a fresh wave of npm supply-chain compromises that Amazon has now formally attributed to a DPRK-linked actor. Both push the risk squarely onto teams running managed WordPress and Node build pipelines — Fruition's core surface. Secondary but consequential: Cisco Secure Firewall Management Center hard-coded credentials on KEV; a Wordfence-confirmed backdoored WordPress plugin (Advanced Responsive Video Embedder, ~20k installs) shipped through the plugin repo; and Iran-linked probing of Minnesota water OT with CISA telling operators to pull PLCs off the public internet now. On the framework side, PHP 8.2–8.5 shipped simultaneous security releases and Netty HTTP/2 has a direct-memory leak reachable over HTTP/2. Recalculate this week: does your WordPress patch SLA cover core-plus-plugin in <72h, and do your npm and composer install paths block newly-published versions until they've aged?
Published
Friday, August 7, 2026
Entries
12
Cadence
Weekly · Sundays
Curator
Brad Anderson
Wire
cisa.gov New addition to the Known Exploited Vulnerabilities catalog ·
github.com GHSA: critical npm package compromise affecting CI pipelines ·
wordfence.com WordPress plugin vulnerability with active exploitation ·
drupal.org Highly critical core security advisory published ·
aws.amazon.com AWS security bulletin: IAM policy evaluation update ·
unit42.paloaltonetworks.com Threat actor expands toolkit targeting public-facing PHP apps ·
krebsonsecurity.com Breach disclosure with named victim and confirmed initial vector ·
snyk.io Composer dependency advisory affecting production framework versions ·
cisa.gov New addition to the Known Exploited Vulnerabilities catalog ·
github.com GHSA: critical npm package compromise affecting CI pipelines ·
wordfence.com WordPress plugin vulnerability with active exploitation ·
drupal.org Highly critical core security advisory published ·
aws.amazon.com AWS security bulletin: IAM policy evaluation update ·
unit42.paloaltonetworks.com Threat actor expands toolkit targeting public-facing PHP apps ·
krebsonsecurity.com Breach disclosure with named victim and confirmed initial vector ·
snyk.io Composer dependency advisory affecting production framework versions ·
01

Web Application

frameworks · browsers · authentication flows

github.com 1d CVSS 7.5

Netty HTTP/2 decompression direct-memory leak crashes JVMs over long-lived connections

Netty's DelegatingDecompressorFrameListener retains a ByteBuf on every HTTP/2 DATA frame but fails to release it when the decompressor channel is already closed. A remote unauthenticated peer can leak one direct ByteBuf per DATA frame across a long-lived HTTP/2 connection, exhausting direct memory and crashing the JVM with OutOfMemoryError.

CVE-2026-56819 Netty
Fruition take

Any Java service exposing HTTP/2 with content-encoding decompression enabled (common in gRPC gateways and Spring WebFlux) should pull the patched Netty. If you can't upgrade this week, disabling automatic HTTP/2 decompression is the workaround.

02

Supply Chain

packages · build systems · dependency attacks

aws.amazon.com 3d
▲ headline

Amazon attributes recent npm library compromises to DPRK-linked actor

Amazon Threat Intelligence linked several recent compromises of popular npm packages to a Democratic People's Republic of Korea (DPRK) threat group, framing the campaign as sustained targeting of open-source libraries used broadly across enterprise builds. Amazon and AWS Linux teams also published guidance on hardening npm and pip install paths against packages that have been public for only a few hours.

npm registry
Fruition take

If your Next.js or Astro builds pull directly from public npm without an aging proxy, add one this week — Verdaccio, JFrog, or CodeArtifact with a minimum-age policy of 24–72h blunts the entire class of attack Amazon is describing.

github.com 1d CVSS 10.0

NocoBase CVSS 10 SQL injection to PG-superuser RCE on default deploy

NocoBase's /api/myInAppChannels:list endpoint splices the filter[latestMsgReceiveTimestamp][$lt] value directly into a Sequelize.literal() template with no binding. The ACL is loggedIn, and the default auth-basic authenticator ships allowSignUp: true, so an anonymous attacker can register and reach it. The pg driver accepts stacked statements; the shipped docker-compose.yml grants the DB role superuser, escalating to RCE.

CVE-2026-52887 NocoBase
Fruition take

If any client runs NocoBase, patch immediately and disable public signup on the auth-basic authenticator. Anyone on the stock docker-compose is one HTTP request away from PostgreSQL superuser.

03

Infrastructure

kubernetes · cloud · network · ingress

github.com 1d CVSS 9.6

Bank-Vaults webhook SSRF enables cross-namespace ServiceAccount token theft

The Banzai Cloud vault-secrets-webhook reads vault.security.banzaicloud.io/vault-addr on any ConfigMap or Secret and uses it as the Vault address with no allowlist. It also holds cluster-wide serviceaccounts/token:create. An attacker who can create ConfigMaps or Secrets in a watched namespace can point the webhook at an attacker-controlled URL and exfiltrate any ServiceAccount token in the cluster via the TokenRequest API.

CVE-2026-54725 vault-secrets-webhook Bank-Vaults
Fruition take

For Kubernetes clusters running vault-secrets-webhook, upgrade and restrict who can create ConfigMaps/Secrets in watched namespaces. Namespace-scope the token-create permission if your fork allows it — cluster-wide is the blast radius here.

04

PHP & CMS

wordpress · drupal · plugins · php frameworks

nvd.nist.gov 1w KEV
▲ headline

CISA adds WordPress core RCE chain (CVE-2026-60137 + CVE-2026-63030) to KEV

CISA added two WordPress core CVEs to KEV: CVE-2026-60137, a SQL injection reachable when a plugin/theme passes untrusted input to a vulnerable parameter, and CVE-2026-63030, an interpretation conflict that chains with it. Chained, an unauthenticated attacker gets SQLi and remote code execution on default installs. WordPress core patches shipped July 17; Wordfence confirmed working WP2Shell exploitation in the wild creating admin accounts.

CVE-2026-60137 CVE-2026-63030 WordPress Core
Fruition take

Every managed WordPress site should already be on the July 17 core release — if any are still behind, treat that as an active incident, not a patch backlog. Also audit for rogue admin users created after mid-July: WP2Shell drops one before pivoting to plugin upload.

php.net 2d

PHP ships coordinated security releases across 8.2, 8.3, 8.4, and 8.5

The PHP project released PHP 8.2.33, 8.3.33, 8.4.24, and 8.5.9 on the same day, all flagged as security releases. All 8.2–8.5 users are advised to upgrade. Release notes are in each branch's ChangeLog; specific CVE detail was not called out in the announcement text.

PHP 8.2 PHP 8.3 PHP 8.4 PHP 8.5
Fruition take

Rebuild WordPress and Drupal container images this week to pick up the new PHP base. Fruition's managed hosting fleet should have all four branches rolled by Friday — the coordinated cross-branch release usually means the underlying issue is not trivial.

drupal.org 3d

Drupal Token Content Access module vulnerable to timing-attack token guessing

Drupal advisory SA-CONTRIB-2026-090 covers CVE-2026-18259 in the Token Content Access module (<3.1.2). The module does not use constant-time comparison for access tokens, allowing a persistent attacker to guess a valid token via timing side-channel and bypass access controls on protected content. Exploitation requires knowing a protected URL and measuring response timing differences.

CVE-2026-18259 Drupal Token Content Access
Fruition take

Low-urgency but worth patching in the next Drupal maintenance window — timing oracles on token comparison are the kind of thing red teams look for on discovery. Confirm which client sites use this module before scheduling.

wordfence.com 3d KEV

WP2Shell: technical breakdown of the exploited WordPress core chain

Wordfence published attack telemetry and technical analysis for the WordPress core vulnerability chain patched July 17. Unauthenticated attackers use the SQLi + interpretation conflict to create an administrator account, then execute code through normal admin capabilities like uploading a malicious plugin. Real-world exploitation is confirmed and ongoing.

CVE-2026-60137 CVE-2026-63030 WordPress Core
Fruition take

The admin-creation-then-plugin-upload pattern is the IOC that matters: hunt for wp_users rows created since July 15 with no corresponding audit trail, and any plugin uploads in that window from non-CI sources.

wordfence.com this week

Backdoored Advanced Responsive Video Embedder plugin caught within two hours

Wordfence's PRISM system flagged an authentication bypass backdoor pushed into Advanced Responsive Video Embedder (a WordPress plugin with ~20,000 active installs) within two hours of the malicious release hitting the plugin repository. Wordfence describes this as a supply-chain attack rather than a coding error, meaning the maintainer account or release pipeline was compromised.

Advanced Responsive Video Embedder
Fruition take

Pin plugin versions in your WordPress deploy manifests and require a 48–72h aging window before auto-updating anything but WP core. If you have this plugin installed, roll back to a pre-backdoor version and rotate any secrets exposed to the site's PHP runtime.

05

Identity & Auth

oauth · saml · iam · session attacks

no entries this week

06

Threat Intel

active exploitation · breaches · ransomware

therecord.media 1d

CISA urges water utilities to pull PLCs offline after Minnesota intrusions

CISA issued a public alert following what Dark Reading and The Record describe as a likely Iran-backed campaign against more than 30 community water systems in Minnesota. CISA's specific guidance: remove publicly exposed PLCs and other OT from the internet as soon as possible. The advisory follows a period of sustained probing rather than a single incident.

Fruition take

For any client that operates OT or SCADA behind a web portal Fruition manages, confirm no PLC HMI or Modbus/DNP3 endpoint is reachable through the web tier or via misconfigured ingress rules. Direct internet exposure of PLCs is the vector CISA is naming.

unit42.paloaltonetworks.com 3d

Unit 42: Chinese-speaking actor pairs autonomous AI scanning with manual exploitation

Palo Alto Unit 42 details a campaign by a Chinese-speaking threat actor combining AI-driven autonomous scanning across seven specific vulnerabilities with hands-on exploitation. The pattern shifts the economics of opportunistic scanning: AI narrows initial reconnaissance and target selection, and human operators take over for exploitation once a viable target is identified.

Fruition take

The practical takeaway is the compressed window: the gap between CVE disclosure and mass scanning is shrinking further. Any n-day in your stack should be patched within days, not weeks. Prioritize by internet-exposure, not CVSS.

nvd.nist.gov this week KEV

Cisco Secure Firewall Management Center hard-coded password added to KEV

CISA added CVE-2026-20316 to KEV: Cisco Secure Firewall Management Center (formerly Firepower Management Center) contains a hard-coded password that lets an unauthenticated remote attacker log in with a low-privileged account and access sensitive data. Federal agencies are required to remediate under BOD 26-04; internet-exposed FMCs are the priority.

CVE-2026-20316 Cisco Secure Firewall Management Center
Fruition take

For clients running FMC as the control plane for perimeter firewalls, verify the management interface is not reachable from the internet and apply Cisco's fixed release. A stolen low-priv session on FMC is a stepping stone to full ruleset visibility.