Public exploits have been released for the critical “wp2shell” remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately.

The wp2shell attack consists of two flaws, tracked as CVE-2026-63030 and CVE-2026-60137, that can be chained together to achieve pre-authentication remote code execution against WordPress installs running versions 6.9.x and 7.0.x.

The flaws were discovered by Adam Kues of Searchlight Cyber, which says an unauthenticated attacker can exploit them against a default WordPress installation.

“Searchlight Cyber’s security research team has discovered a pre-authentication RCE in WordPress Core,” explained Searchlight Cyber.

“The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins.”

Searchlight Cyber estimates that more than 500 million websites use WordPress, giving the vulnerability a potentially massive impact, especially now that public proof-of-concept exploits have been released.

Due to the severity of the vulnerabilities, the WordPress security team has enabled forced automatic security updates for supported installations running affected versions, urging site owners to update to WordPress 7.0.2 or 6.9.5 immediately.

“Because this is a security release, it is recommended that you update your sites immediately,” WordPress said in its security announcement.

“Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions.”

The issue is not a single vulnerability but rather two independent flaws that can be combined into an unauthenticated remote code execution chain.

The first flaw, CVE-2026-63030, is a REST API batch-route confusion vulnerability introduced in WordPress 6.9. According to the GitHub advisory, the flaw can be combined with the SQL injection issue to achieve remote code execution.

The second vulnerability, CVE-2026-60137, is an SQL injection flaw in the ‘author__not_in‘ parameter of ‘WP_Query'. WordPress describes it as a high-severity SQL injection vulnerability affecting WordPress 6.8 and later.

According to the WordPress advisories, the complete RCE chain affects WordPress 6.9.0 through 6.9.4 and WordPress 7.0.0 through 7.0.1.

The SQL injection vulnerability also affects WordPress 6.8.0 through 6.8.5, but cannot be chained to remote code execution because the REST API batch-route confusion bug was added in WordPress 6.9.

The full wp2shell attack chain has been fixed in WordPress 6.9.5 and 7.0.2.

Searchlight Cyber is currently withholding technical details to give administrators time to patch, instead creating the wp2shell.com website, which allows admins to test whether their WordPress installations are vulnerable.

For organizations unable to immediately update, Searchlight Cyber recommends:

• Installing a plugin that blocks anonymous access to the REST API entirely; or
• Blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 at a WAF level.

The company warns these mitigations should only be used as a temporary measure until systems can be updated.

Cloudflare also announced that it has deployed Web Application Firewall (WAF) protections for both vulnerabilities across all plans, including free accounts, that are proxied behind its platform.

According to Cloudflare, the rules block attempts to exploit both the SQL injection flaw (CVE-2026-60137) and the REST API batch-route confusion vulnerability (CVE-2026-63030).

“WAF protections reduce exposure while customers update, but they are not a substitute for patching,” Cloudflare said.

Public PoC exploits released

While Searchlight Cyber delayed releasing technical details to give administrators time to patch, multiple public proof-of-concept exploits have since been published on GitHub.

Some publicly available exploits combine the two vulnerabilities to extract WordPress password hashes via SQL injection, then crack an administrator password to log in, upload a malicious plugin, and execute commands.

However, other proof-of-concept exploits claim to achieve pre-authentication remote code execution without requiring administrator credentials, which is more in line with Searchlight Cyber’s description of the flaws.

BleepingComputer has contacted Searchlight Cyber to confirm that its attack chain does not require an administrator password.

Security firm watchTowr says it has already seen in-the-wild exploitation after the public exploits were released.

“WordPress gets a bad rap for security. But the reality is that a highly impactful, unauthenticated SQL injection or remote code execution vulnerability in WordPress core is actually fairly rare,” watchTowr CEO Benjamin Harris told BleepingComputer via email.

“That is exactly what makes this one different, and why everyone is scrambling to patch before widespread exploitation takes hold. The watchTowr team is already seeing PoC exploits in circulation, and we are beginning to see the first signs of in-the-wild exploitation.”

Given the availability of public proof-of-concept exploits and the first reported signs of in-the-wild exploitation, administrators should ensure their sites are updated to WordPress 7.0.2 or 6.9.5 as soon as possible.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper

It’s pretty clear that EVs and software defined vehicles (SDVs) go hand-in-hand these days, and while Tesla paved the way with the Model 3 back in 2017, Rivian, Lucid, and Chinese manufacturers quickly followed. The legacy car manufacturers are taking a while longer to get on board, but are finally catching up. Companies like Hyundai Motor Group, General Motors, BMW, and Mercedes-Benz are starting to launch full SDVs.

SDVs for the win

Kini is very reliable. I tested it in a drawer and a cabinet, and it always alerted me when they were opened. It also keeps a log with times listed. While alerts go via the cloud, maker Kinisium says it doesn’t collect data, and you can turn off logging entirely if you prefer. Kini also has a Stasis mode, so you can reverse it and have it alert you when there has been no movement for a set period. This makes it a versatile monitoring device, and you could use this mode to ensure an elderly relative opens their medicine cabinet each day or check what time your dog walker opened a door. Kini is also compatible with IFTTT for automation, and there’s even a webhook integration that can send notifications to a custom URL.

More Motion Sensors

There are loads of other motion sensors that can alert you to motion or presence in an area or room and trigger lighting, but the right one for you depends on your current smart-home setup.

I really like the Eve Motion Sensor, but if you want it to trigger alerts, you need a smart-home hub, and you must set up an automation. It’s a reliable sensor that works indoors or out. I tested it with a Google Home system.

The Aqara FP2 Presence Sensor ($83) has many features, including zonal and multiple person detection, and is compatible with all the major smart-home ecosystems, though it’s not always very accurate at identifying the number of people in the room. The more affordable Aqara FP300 ($50) is a good enough presence detector for most folks and can also track light, temperature, and humidity.

The Switchbot Presence Sensor ($30) is the most affordable sensor I tested and has a similar feature set, but you will need a Switchbot hub if you want alerts, and there’s a lag between it detecting and alerting.

The Philips Hue Outdoor Motion Sensor is excellent, but only if you already have a Hue setup, because it needs a Hue Bridge to connect to. I installed the sensor in my backyard and tested it with the Bridge Pro. It reliably detects people with few false positives. I configured my outdoor sensor to turn on a backyard light strip (not Hue) after sunset and send me a notification when triggered between specific hours (midnight and 6 am) using Google Gemini.

There’s also a Philips Hue Indoor Motion Sensor and a Contact Sensor ($40) for doors and windows. Both are very reliable and can be configured to trigger alerts.

Smart Light Sensing

As an interesting alternative to dedicated motion sensors, you can also use some smart lights for detect presence and motion indoors.

Wiz SpaceSense

If you have a few Wiz lights, you can try SpaceSense, which uses Wi-Fi to detect motion in rooms. I wasn’t that impressed when I tried SpaceSense, but how effectively it works depends on how many Wiz lights you have and where they are located. I was also testing it as a way to automatically turn lights on, and there’s some lag that limits its usefulness on that score. But as a security alert that can tell you when there’s motion in your home when you’re away, it could be very useful. If you already have Wiz lights, you may as well try it, as it doesn’t require a subscription.

Philips Hue MotionAware

Signify is the parent company of Wiz and Philips Hue, and MotionAware is very similar to SpaceSense, but it uses Zigbee, rather than Wi-Fi. Again, how well it works depends on the number of Philips Hue lights you have and their layout. Unfortunately, it does require a subscription if you want to receive alerts. MotionAware can trigger lights at no extra cost, but if you want motion alerts, you must pay $1 per month or $10 for the year. It is also included in Hue Secure subscriptions from $4 per month.

More Security System Alternatives

SimpliSafe

8-Piece Wireless Home Security System

You might consider a modular security system. We like the Simplisafe system, which offers a base station, keypad, and a range of sensors. You can also find modular systems from security stalwarts like ADT and Vivint, and security camera makers like Eufy and Arlo.

The Department of Justice says that federal employees can now download TikTok on their government devices, according to Reuters.

A 2022 law banned federal employees from using the short-form video app on those devices, but the DOJ reportedly says the law no longer applies, thanks to a deal transferring ownership of TikTok’s U.S. operations to a joint venture backed by Oracle, Silver Lake, and MGX. (Oracle serves as the security partner for the new joint venture, while previous owner ByteDance retains a 19.9% stake.)

The DOJ memo reportedly says President Donald Trump has cleared “employees of Executive Branch agencies” to “download TikTok onto their official devices, subject ​to the agency’s discretion and consistent with all applicable workplace policies.”

Following the ban focused on government employees and devices, the app was banned more broadly across the United States. But just as the law took effect early last year, the app only went down briefly before Trump repeatedly delayed the move and urged service providers to restore access.

Kylian Mbappe is set to face Real Madrid team-mate Jude Bellingham as France take on England in the FIFA World Cup 2026 third place play-off in Miami — and you can live stream the game around the world for free.

Les Bleus were many people’s favourites to win the tournament, but a deeply disappointing 2-0 defeat by Spain in the semi-finals ended their hopes of lifting the World Cup for a third time. While a bronze medal would feel like scant consolation, France will nonetheless be motivated to triumph. Manager Didier Deschamps ends a hugely successful 14-year spell in charge of Les Bleus after this game and he will be keen to finish on a high, while captain Mbappe heads into the last weekend of the tournament level on eight goals with Lionel Messi in the race for the Golden Boot.

Hours of San Francisco Police Department drone video footage exposed on the open web illustrates a new era of incredibly granular—and consequential—urban surveillance. Meanwhile, the San Francisco City Attorney’s Office sent cease-and-desist letters to Apple and Google this week demanding that the tech giants delete 13 AI nudifying “face-swap” apps from their app stores that are almost exclusively used to target women and girls.

Since WIRED first reported in June about Meta’s NameTag face-recognition system, company executives have made opaque and conflicting comments about whether the feature even exists. We took a step back to lay out both the claims and the facts about the very real system.

In a speech on Thursday, President Donald Trump continued to push unsubstantiated and thoroughly debunked claims about interference in the 2020 US election. He even promised massive revelations in a trove of documents posted to the White House website, but the files did not prove his assertions—and in some cases actually contradicted Trump’s claims.

As adoption of AI tools rapidly expands and their capabilities increase, the tech giant Anthropic continued a push to get US states to regulate AI. Speaking about AI transparency requirements in California and New York from last year, Anthropic’s head of US state and local government relations, Cesar Fernandez, told WIRED this week, “The transparency-focused safety bills of 2025 were a really important start, but as the capabilities of AI systems continue to advance quickly—the policy responses need to match.”

And there’s more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

The astrology-themed period tracker Stardust sends users’ reproductive health details—birth control type, pregnancy status, moods, and symptoms as specific as tender breasts and stomach cramps—to a data firm not named in its privacy policy, according to the BBC, which first reported a Mozilla Foundation audit of six popular trackers produced in partnership with Harvard’s Berkman Klein Center.

Stardust scored 2 out of 10, the worst of the group. Mozilla researcher Shoshana Wodinsky found the app pings third-party trackers from the moment it opens, before a user enters anything; the instant she logged a symptom, the details went to analytics firm RudderStack alongside a persistent user ID, with no in-app way to shut the sharing off. RudderStack is built to route data onward to destinations Mozilla couldn’t observe. Stardust also hands Facebook an ad identifier that ties in-app behavior to the platform’s existing profiles. The company told TechCrunch it has never received a legal demand for user data.

Euki, a nonprofit-run tracker, earned a perfect 10: no account required, health data never leaves the phone, and users can set a PIN, schedule automatic deletion, or pull up a decoy screen if someone forces the phone open. Its one soft spot is an in-app browser for educational pages that loads the usual web trackers, but it also resets identifiers between visits.

Russia’s FSB has long had a reputation for highly sophisticated cyberespionage, leaving disruptive cyberattacks to its fellow hackers in the country’s GRU military intelligence agency. But sanctions from the EU and UK this week, along with an advisory from the US Cybersecurity and Infrastructure Security Agency, the FBI, and the NSA, pinned a cyberattack against the Polish electric grid on Center 16 of the FSB, a rare example of the Kremlin agency carrying out a cyberattack that nearly caused outages in the country’s electric and water utilities. The attack, which the Polish government has said came “very close” to causing a blackout, was initially attributed by cybersecurity firms Dragos and ESET to Sandworm, also known as Unit 74455 of the GRU, a more usual suspect in infrastructure hacking given its active role in Russia’s long-running cyberwar against Ukraine. But the Polish computer emergency response team at the time disputed that finding and tied the attack to the FSB, a conclusion now supported by a wide consensus of Western governments. The incident suggests that the FSB may be taking on some of the reckless, highly aggressive tendencies—and targeting—of its GRU coworkers.

For years, the Russian cybersecurity firm Kaspersky has been alleged to have ties to the Russian government, including by US officials who banned use of the company’s products within the US government and eventually by all American customers. Yet overt evidence of those connections has been scarce. Now Reuters reports that Denis Obrezko, a Russian man facing hacking charges in Boston and an alleged member of a hacker group known as Void Blizzard or Laundry Bear, spent two years working at Kaspersky. His stint at the company took place just before he joined another cybersecurity company, Yutek-NN, where he allegedly took part in the group’s hacking campaign that stole data and communications from numerous NATO governments and at least 11 US companies, according to US prosecutors. Prior to Kaspersky, Obrevko also allegedly worked at the FSB, neatly bookending his time at the company with apparent work for Russia’s intelligence services.

Obrevko has pleaded not guilty to the hacking charges. Kaspersky responded in a statement to Reuters that “the offenses charged cannot be related to the individual’s role or responsibilities during the employment at Kaspersky.”

In an incident that will induce anxiety in anyone responsible for assessing suspicious network activity, DHS officials ruled—twice—that signs of a hacker breach in its data-sharing Homeland Security Information Network platform were false positives when they were, in fact, signs of a very real intrusion. HSIN, used for sharing unclassified data between state, local, and federal agencies, as well as foreign partners, was breached by hackers two months ago, according to reporting from Nextgov/FCW. Analysts at the Federal Emergency Management Agency spotted signs of hacker activity in mid-May—altering files and code, hijacking a legitimate web server, and deleting logs of their behavior—but the findings were dismissed as a false positive.

In the weeks that followed, the hackers returned, were again detected, and were again dismissed as a mirage. It’s not clear why the signs of the breach were misjudged, but the incidents may represent federal analysts’ increasing challenges in detecting “living off the land” hacking techniques that use legitimate features of networks to access target assets on a network rather than planting more easily spotted malware. While the HSIN houses only unclassified data, the information is “highly sensitive,” Senate Intelligence Committee vice chair Mark Warner said in a statement following the report of the breach, and “its exposure risks national security.”

The AI music startup Suno scraped millions of songs, lyrics, and podcasts from YouTube Music, Deezer, Genius, and a string of stock-audio libraries to train its models, according to 404 Media, which reviewed internal data provided by a hacker who breached the company. The intrusion also exposed account information for hundreds of thousands of customers, including emails, phone numbers, and Stripe payment records.

Dataset notes in source code apparently from 2023 and 2024 tally 113,879 hours of YouTube Music audio alone, plus tens of thousands more from Pond5, Deezer, and other libraries—decades of music in total. Other files show Suno routing its YouTube scraping through Bright Data proxies and using PodcastIndex to target roughly 1 million hours of podcasts. The hacker, who goes by ellie.191, says they broke in by compromising an employee with the Shai-Hulud worm.

The files seemingly corroborate the record industry’s central allegation that Suno pulled songs directly from YouTube. The company, which argues that its training qualifies as fair use and settled with Warner Music Group last November, said the breach involved outdated code and no sensitive personal information—though customers whose data appeared in a sample shared with 404 Media said they were never notified.

The original lawsuit was filed in 2023 and claimed Twitter hosted thousands of cases of copyright infringement.

On first impressions, the Laifen T1 Pro wows. Open the box and you’re greeted with Apple-inspired packaging, while the shaver itself immediately looks the part. Its CNC-machined unibody aluminium body looks and feels genuinely premium and, if you’re used to cheaper shavers like the Philips OneBlade – my usual razor – it’s impossible not to grin at the magnetically attached shaving head, which somehow manages to feel genuinely futuristic.

Modern conveniences like USB-C charging, an aeroplane mode to stop the power button being pressed in your bag while travelling and IPX7 waterproofing all add to the premium feel. Based on the spec sheet and those first impressions, you’d be forgiven for thinking the Laifen T1 Pro was one of the best electric shavers on the market.

from the so-very-free-speechy dept

JK Rowling has spoken about how she wrote the first Harry Potter book while she was employed at Amnesty International and how much that experience influenced her writing, and how she learned “the power of human empathy” from working there. Rowling was also, you’ll recall, one of the high profile signers of the infamous Harper’s Letter on “open debate.”

Now she’s threatening to bankrupt Amnesty International for expressing an opinion about Beira’s Place, a “women only” charity Rowling created.

Amnesty International UK had released a report, expressing its well-supported opinion about so-called “anti-rights actors,” specifically calling out a number of groups that it believed, through their statements or actions, sought to “restrict human rights by undermining human rights protections in law and practice.” It had a section on “anti-gender” efforts by some groups which have targeted trans rights and pointed out that:

“Human rights are interconnected and mutually reinforcing. When the rights of one group are restricted, protections for others can also be weakened, even where the effects are not immediately visible.”

This should be a fairly non-controversial statement. But, the report named a number of organizations that it deemed to be “gender critical,” which are, in effect, organizations that have — through their words or actions — done damage to trans rights in particular, and the wider LGBTQ+ space.

No matter your stance on any of this, expressing an opinion about an organization should be seen as part of their free speech and… what’s the term Rowling used in the Harper’s letter? Right, “open debate.”

But, no, not here. One of the organizations that Amnesty mentioned was Beira’s Place, which Rowling helped create as an organization to provide support for female victims of sexual violence. However, aligned with Rowling’s transphobic views and campaigning, the organization proudly insists that it is for “women only.” Beira’s Place and the constant verbiage surrounding it about being for “women only” have certainly contributed to the sense that it is another part of Rowling’s transphobic mission to diminish and deny rights of transgender women.

To look at Rowling’s X feed, for example, is to witness a near never-ending stream of gleefully obnoxious and petty attacks on trans people who speak up for their own rights. I’d post examples, but I’d rather not give any more attention to that sort of hateful messaging.

Thus it’s entirely reasonable to have and express the opinion that Beira’s Place and other operations that refuse to recognize the rights of trans women (and trans men) are “anti-rights.” I mean, literally part of Beira’s Place’s messaging to the world has been its anti-trans stance.

After all, as the statement above notes, when you deny rights to one group, you are weakening rights for all. And, look, even if you somehow agree with Rowling, if you actually believed in free speech and “open debate” you should at least support Amnesty UK in expressing their opinion that being anti-trans is being anti-rights.

But Rowling seems to absolutely loathe any actual “open debate” regarding her views towards the trans community. Thus, she spoke out angrily about the Amnesty report, leading to a media fury, and causing the organization to pull it down. She has also demanded an apology and threatened to sue the organization:

Lawyers acting for the centre have threatened Amnesty with court action unless it permanently withdraws the report, publicly apologises to the blacklisted groups and commissions an external investigation into how it came to be published.

The letter said: “The [Amnesty] report has wrongly labelled all associated with Beira’s Place, including those accessing support as anti-rights bigots who are seeking to weaken human rights.

“This is a shocking way to describe those who are seeking help to overcome the trauma of sexual violence. There is no basis for these allegations, and our client, with the support of its founder JK Rowling, will not sit back and allow the reputation of Beira’s Place or those who access its support to be tarnished in this way.”

Advertisement

And to make it clear she seeks to burden Amnesty UK with as many costly lawsuits as possible, she’s offering to fund other organizations that wish to sue Amnesty International UK over this report.

That’s her tweeting:

Should any of the women’s organisations targeted by Amnesty UK’s recent ‘anti-rights’ blacklist wish to take legal action, applications can be made to the JK Rowling Women’s Fund.

So much for free speech and open debate, huh?

Rowling has a right to express her own bigotry and hateful views. But Amnesty International and anyone else should also be able to express their opinion that by her words and her deeds she is doing real harm to the rights of trans people worldwide. But Rowling is making every effort to shut that down.

I am sure that Rowling and her supporters will claim, ridiculously, that because she views Beira’s Place and her other anti-trans activism as “pro-women’s rights” that it is somehow defamatory to call it anti-rights. But that’s why it’s a protected opinion. Whether or not one’s views and actions are pro or anti-rights is, inherently, an opinion.

My opinion is that Rowling is a hateful, angry woman who has done tremendous harm to some of the most marginalized people in the world for no reason at all, and her wink wink nod nod “I’m just supporting women’s rights” bullshit as cover for that is both craven and pathetic. She has contributed to a hateful, anti-rights movement that has put millions of people at greater risk. That she is now seeking to effectively silence and potentially destroy the organization that she, herself, claims was so valuable in getting her to understand the value of human empathy is a particularly sad statement on where her life has taken her.

Meanwhile, I’m still waiting for literally any of her Harper’s Letter co-signers to call out her attacks on the organization’s speech, and threats to their existence for expressing an opinion she doesn’t like. Apparently, that kind of “open debate” is too much?

Filed Under: defamation, free speech, human rights, jk rowling, lgbtq, terfs, trans rights

Companies: amnesty international, beira’s place