⚠️ WordPress: critical wp2shell vulnerability — attacks in progress

A wp2shell chain was found in WordPress Core (CVE-2026-63030 + CVE-2026-60137). Disclosed July 17, 2026; active exploitation confirmed.

Unauthenticated attackers can get remote code execution — no login, no plugins required.

Who's affected

▎Full RCE: 6.9.0–6.9.4, 7.0.0–7.0.1
▎SQLi only: 6.8.0–6.8.5 (no RCE chain)
▎version.php may show just 7.0 — same vulnerable branch

What to do

▎Update to 7.0.2, 6.9.5, or 6.8.6
▎Check version manually on every site — auto-updates may lag
▎Can't update yet? Block both at nginx/WAF:

/wp-json/batch/v1
?rest_route=/batch/v1

Signs of compromise

▎New admin user named wp2_… / w2s_… in the database — check even if logs look clean
▎HTTP 207 (sometimes 200) on batch — strongest signal, especially unusually large responses
▎UA wp2shell / rezwp2shell — common in PoCs, but attackers often spoof normal browsers
▎GET /wp-json/wp/v2/users?context=edit — admin enumeration
▎POST /wp-admin/update.php?action=upload-plugin — backdoor upload
▎Unknown plugins (e.g. fake "CMSmap")

🔑 Found traces? Rotate admin/DB passwords — the SQLi pulls password hashes for offline cracking. Also rotate wp-config.php salts to kill any hijacked sessions.

Both CVEs hit CISA's KEV catalog on July 21. Public exploits are out.

🧠 Attackers got the same AI upgrade you did. They're just using it more.

The easier AI gets, the faster they move: bulk scans, fresh CVEs turned into working exploits within hours, phishing without the usual tells. And filtering got sharper too — DPI increasingly flags VPNs and proxies by their fingerprints.

Default settings alone won't cut it. Lock down your perimeter, keep your traffic under control. 4 guides on that.

🔥 What Is a Firewall — how it works, and which type fits your setup
🔗 https://alexhost.com/faq/what-is-a-firewall-how-it-works-why-it-matters-and-which-type-fits-your-setup/

⚡ What Is XDP — dropping packets before the network stack ever sees them
🔗 https://alexhost.com/faq/what-is-xdp-and-how-can-it-help-build-anti-ddos-protection/

💻 Install 3x-ui on a VPS — and pick the right anti-censorship config
🔗 https://alexhost.com/faq/how-to-install-3x-ui-on-a-vps-and-choose-the-right-anti-censorship-configuration/

🔍 How to Check a Server for Malware — what to look for, and which detection approach fits your setup
🔗 https://alexhost.com/faq/how-to-check-a-server-for-malware-what-to-look-for-and-which-detection-approach-fits-your-setup/
One honest note before you start: read the malware one first. A firewall protects a clean server — if something is already inside, it just keeps it company.

🌟 Everything else we've written — Linux, networking, security, web:
🔗 https://alexhost.com/faq/

🤝 Nobody thanks you for the outage that didn't happen.

That's the whole job. You get noticed when something breaks — never when it doesn't.

The patch you pushed on Saturday.
The backup you restored before anyone asked.
The alert at 02:14 that everyone else slept through.

99.9% uptime isn't a number on a status page. It's somebody's Tuesday.

Today is System Administrator Appreciation Day. We've been on your side of the pager since 2008 — we know what that week costs.

Marking the day - 15% off all new services

CODE: SYSADMIN
Through August 7

👉 https://alexhost.com

🛠 Last Friday was SysAdmin Appreciation Day — so here's some news about ours.

You can now officially put our engineers to work on your server — even on unmanaged VPS, dedicated, or colocation. Any admin task, on demand:

▎Scheduled (24h in advance) — €20/hour
▎Instant — we start right away — €100/hour
▎Nights & weekends (booked in advance) — €100/hour

Estimate before you pay, written report after, unused hours back to your balance.

💻 And a gift to go with it: free website migration — up to 5 domains and 20 GB.

Nothing else changes: standard support stays free, your plan prices stay the same. But tasks we sometimes did as informal favors now have a price — and in return, a guarantee, a timeline, and the same rules for everyone.

🔗 https://alexhost.com/server-administration/

🧠 Renting the server is the fast part. Learning to live on it takes a year - and that year is barely written down.

Linux documentation comes in two useless kinds: man pages for people who already know, and "what is an operating system" for people who don't. The person who rented a VPS yesterday sits exactly between them.

So we wrote the in-between part, in the order you'll need it:

🐧 How to Choose Your Perfect Linux Distro — one guide says apt, your server says dnf, and nobody explains why
🔗 https://alexhost.com/info/how-to-choose-your-perfect-linux-distro/

🔌 SSH, RDP, VNC — three ways in, and the familiar one is often the wrong one
🔗 https://alexhost.com/faq/how-to-access-a-remote-computer-or-server-ssh-rdp-vnc-and-when-to-use-each/

⌨️Your First Week on a Linux Server — 35 commands, because the four you know won't get you through it
🔗 https://alexhost.com/faq/your-first-week-on-a-linux-server-35-essential-commands/

💻 Using tmux — the connection drops and takes the running process with it
🔗 https://alexhost.com/faq/using-tmux-a-terminal-multiplexer/

🌟 Everything else we've written — Linux, networking, security, web:
🔗 https://alexhost.com/faq/

⚠️ Official AlexHost Update - Ongoing DDoS Attack

Since Saturday, August 22, AlexHost has been experiencing a large-scale DDoS attack affecting parts of our network infrastructure and causing service disruptions for some customers.

Our technical teams are actively mitigating the attack together with our upstream providers and Anti-DDoS partners, while services are being restored progressively.

There is currently no indication of a data breach or unauthorized access. This is an availability and connectivity issue.

Individuals claiming responsibility for the attack have demanded a ransom.
AlexHost will not pay or negotiate with attackers.

Our resources will be invested in protecting our customers, strengthening our infrastructure, and improving mitigation capacity - not in rewarding those attempting to disrupt our services.
All actions taken by AlexHost remain strictly within the law and established cybersecurity practices.

⚠️ If anyone contacts you offering to stop the attack or restore your services in exchange for payment, do not pay, do not share credentials, and report the message to our official support team.

Our priority remains clear: protect our customers, restore services, and strengthen our network.

Thank you for your patience and continued trust.

— AlexHost Team