π¨ WordPress patches XSS2Shell flaw that could lead to server code execution
CVE-2026-64638 is a CVSS 8.9 pre-authentication XSS vulnerability in the WordPress login screen.
The XSS itself requires no account. Researchers at pwn.ai demonstrated how it can be chained against a logged-in administrator to reach PHP code execution after social engineering the admin into interacting with an attacker-controlled page.
A successful chain could potentially allow attackers to:
β’ Create API credentials
β’ Gain authenticated REST access
β’ Upload malicious plugin files
β’ Execute PHP on the server
β’ Access WordPress secrets and database credentials
WordPress 7.0.3 fixes the flaw, with patches backported through the 4.7 branch.
NHS England says exploitation is likely following the release of technical details and a PoC.
WordPress has not reported confirmed exploitation in the wild as of August 7.
Update immediately.
CVE-2026-64638 is a CVSS 8.9 pre-authentication XSS vulnerability in the WordPress login screen.
The XSS itself requires no account. Researchers at pwn.ai demonstrated how it can be chained against a logged-in administrator to reach PHP code execution after social engineering the admin into interacting with an attacker-controlled page.
A successful chain could potentially allow attackers to:
β’ Create API credentials
β’ Gain authenticated REST access
β’ Upload malicious plugin files
β’ Execute PHP on the server
β’ Access WordPress secrets and database credentials
WordPress 7.0.3 fixes the flaw, with patches backported through the 4.7 branch.
NHS England says exploitation is likely following the release of technical details and a PoC.
WordPress has not reported confirmed exploitation in the wild as of August 7.
Update immediately.
I have added 8 forums to the Forums Status Monitoring section on the threat feed, that are currently being onboarded. Almost all of them are of the carding variety. CTRL+SHIFT+R to refresh the page. No dates as to completion, but you will know once done.
π₯1
π¨βΌοΈπ¨ URGENT π¨βΌοΈπ¨
BTCPay Server disclosed Friday that a critical vulnerability is being actively exploited and urged users to update their servers to version 2.4.2 immediately, according to the projectβs official X account.
The team warned that user funds could be at risk, although it remains unclear how many servers have been compromised or whether any funds have been stolen.
Users who cannot update immediately were advised to shut down their BTCPay Server instances to prevent potential unauthorized access until the patch can be applied.
Details about the vulnerability and the ongoing exploitation remain limited. The Block said it contacted BTCPay Server for additional information.
Source: https://x.com/BtcpayServer/status/2085755643659522240
BTCPay Server disclosed Friday that a critical vulnerability is being actively exploited and urged users to update their servers to version 2.4.2 immediately, according to the projectβs official X account.
The team warned that user funds could be at risk, although it remains unclear how many servers have been compromised or whether any funds have been stolen.
Users who cannot update immediately were advised to shut down their BTCPay Server instances to prevent potential unauthorized access until the patch can be applied.
Details about the vulnerability and the ongoing exploitation remain limited. The Block said it contacted BTCPay Server for additional information.
Source: https://x.com/BtcpayServer/status/2085755643659522240
X (formerly Twitter)
BTCPay Server (@BtcpayServer) on X
There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.
Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Serve
Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Serve
π¨π«π· AFPABox user data and administrator access allegedly leaked
β
A forum actor claims to have leaked data associated with AFPABox, a platform connected to AFPA, Franceβs national adult vocational training organization. The post also claims administrator access to the platform.
β
The leak allegedly includes 101 user records containing:
β
β’ First and last names
β’ Positions and account statuses
β’ User messages
β’ Ages and gender information
β’ Registration dates
β’ Local time and language settings
β’ Last-visit timestamps
β’ User identifiers
β
This claim is currently unverified.
β
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
β
A forum actor claims to have leaked data associated with AFPABox, a platform connected to AFPA, Franceβs national adult vocational training organization. The post also claims administrator access to the platform.
β
The leak allegedly includes 101 user records containing:
β
β’ First and last names
β’ Positions and account statuses
β’ User messages
β’ Ages and gender information
β’ Registration dates
β’ Local time and language settings
β’ Last-visit timestamps
β’ User identifiers
β
This claim is currently unverified.
β
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
βΌοΈ Exploit Forum:
Exploit[.]in:
198[.]144[.]121[.]93
π³π± ASN: 206264
Organization: Amarutu Technology Ltd
send[.]exploit[.]in:
195[.]206[.]181[.]20
π¬π§ ASN: 25369
Organization: Hydra Communications Ltd
notes[.]exploit[.]in
31[.]220[.]0[.]206
π§πΏ ASN: 206264
Organization: Amarutu Technology Ltd
Exploit[.]in:
198[.]144[.]121[.]93
π³π± ASN: 206264
Organization: Amarutu Technology Ltd
send[.]exploit[.]in:
195[.]206[.]181[.]20
π¬π§ ASN: 25369
Organization: Hydra Communications Ltd
notes[.]exploit[.]in
31[.]220[.]0[.]206
π§πΏ ASN: 206264
Organization: Amarutu Technology Ltd
π3β€1
IP Information for 89.39.149.156
ASN: 19624
ISP / Org: SERVERROOM - Data Room, Inc, US
Country: RO
Network Range: 89.39.149.0/24
ASN: 19624
ISP / Org: SERVERROOM - Data Room, Inc, US
Country: RO
Network Range: 89.39.149.0/24
β€1
πͺ Slice For Life - Part 2 πͺ
βΌοΈ Exploit Forum: Exploit[.]in: 198[.]144[.]121[.]93 π³π± ASN: 206264 Organization: Amarutu Technology Ltd send[.]exploit[.]in: 195[.]206[.]181[.]20 π¬π§ ASN: 25369 Organization: Hydra Communications Ltd notes[.]exploit[.]in 31[.]220[.]0[.]206 π§πΏ ASN: 206264β¦
forum[.]exploit[.]in
89[.]39[.]149[.]156
π·π΄ ASN: 19624
Organization: Data Room, Inc
89[.]39[.]149[.]156
π·π΄ ASN: 19624
Organization: Data Room, Inc
β€1
If you support this forum... go fuck yourself. Amarutu Technology Ltd, which operates the DDoS protection and hosting provider KoDDOS, has been identified in European parliamentary and academic monitoring reports as infrastructure associated with significant levels of online abuse. Research examining network abuse has also flagged its autonomous system as a notable hosting provider linked to the distribution of child sexual abuse material (CSAM).
β€4
1/2π¨ Cl0p Ransomware claims 44 victims
π¨π³ Mindray - A global medical technology manufacturer. The listing claims 50 GB of databases and project files, with listed revenue of $5 billion.
πΊπΈ Continental Aerospace Technologies - A U.S. aerospace manufacturer specializing in aircraft engines and components. The listing claims 347 GB of databases and project files, with listed revenue of $91 million.
net****** - Redacted organization. The listing claims 230 GB of projects, CAD files, backups, and Windchill files, with listed revenue of $370.9 million.
sh****** - Redacted organization. The listing claims 89 GB of engineering drawings, facility photographs, facility testing reports, and project plans, with listed revenue of $2.673 trillion.
g****** - Redacted organization. The listing claims 391 GB of software backups, system files, and projects, with listed revenue of $113 billion.
fis****** - Redacted organization. The listing claims 874 GB of projects, CAD files, Windchill files, and software, with listed revenue of $21.2 billion.
phi****** - Redacted organization. The listing claims 13.5 GB of PDF drawings, diagrams, and blueprints, with listed revenue of $20.7 billion.
ald****** - Redacted organization. The listing claims 424 GB of TSV files, software, projects, and CAD files, with listed revenue of $14.8 billion.
jr**** - Redacted organization. The listing claims 556.4 GB of CAD files, PDF drawings, diagrams, product presentations, specifications, manuals, and instructions, with listed revenue of $7.8 billion.
toa****** - Redacted organization. The listing claims 215 GB of project data, database backups, and logs, with listed revenue of $6.4 billion.
lar****** - Redacted organization. The listing claims 56 GB of project files and software, with listed revenue of $1.7 billion.
sta****** - Redacted organization. The listing claims 3,030 GB of databases and project data, with listed revenue of $939.2 million.
par****** - Redacted organization. The listing claims 24 GB of databases, projects, CAD files, and backups, with listed revenue of $475.7 million.
mam****** - Redacted organization. The listing claims 136 GB of PNG and Windchill files, with listed revenue of $281 million.
cor****** - Redacted organization. The listing claims 3,684 GB of databases, projects, PDFs, TXT files, and DOC files, with listed revenue of $269.8 million.
mam****** - Redacted organization. The listing claims 1.18 GB of databases and project files, with listed revenue of $131 million.
tri****** - Redacted organization. The listing claims 1,579.9 GB of databases and project files, with listed revenue of $1 billion.
sma****** - Redacted organization. The listing claims 6.08 GB of databases and project files, with listed revenue of $113 million.
suu****** - Redacted organization. The listing claims 1,470 GB of databases and project files, with listed revenue of $111 million.
bri****** - Redacted organization. The listing claims 22.4 GB of databases and project files, with listed revenue of $100 million.
jpm****** - Redacted organization. The listing claims 75.4 GB of databases and project files, with listed revenue of $400 million.
clo****** - Redacted organization. The listing claims 651 GB of databases and project files, with listed revenue of $400 million.
ato****** - Redacted organization. The listing claims 980 GB of databases and project files, with listed revenue of $68 million.
hon****** - Redacted organization. The listing claims 1,588 GB of databases and project files, with listed revenue of $470 million.
int****** - Redacted organization. The listing claims 261 GB of databases, projects, PDFs, XLSX, XLS, and DOCX files, with listed revenue of $31 million.
int****** - Redacted organization. The listing claims 271 GB of databases, projects, backups, software installers, updates, and XML files, with listed revenue of $27 million.
gal****** - Redacted organization. The listing claims 382 GB of databases, projects, project backups, and SQL database backups, with listed revenue of $15 million.
π¨π³ Mindray - A global medical technology manufacturer. The listing claims 50 GB of databases and project files, with listed revenue of $5 billion.
πΊπΈ Continental Aerospace Technologies - A U.S. aerospace manufacturer specializing in aircraft engines and components. The listing claims 347 GB of databases and project files, with listed revenue of $91 million.
net****** - Redacted organization. The listing claims 230 GB of projects, CAD files, backups, and Windchill files, with listed revenue of $370.9 million.
sh****** - Redacted organization. The listing claims 89 GB of engineering drawings, facility photographs, facility testing reports, and project plans, with listed revenue of $2.673 trillion.
g****** - Redacted organization. The listing claims 391 GB of software backups, system files, and projects, with listed revenue of $113 billion.
fis****** - Redacted organization. The listing claims 874 GB of projects, CAD files, Windchill files, and software, with listed revenue of $21.2 billion.
phi****** - Redacted organization. The listing claims 13.5 GB of PDF drawings, diagrams, and blueprints, with listed revenue of $20.7 billion.
ald****** - Redacted organization. The listing claims 424 GB of TSV files, software, projects, and CAD files, with listed revenue of $14.8 billion.
jr**** - Redacted organization. The listing claims 556.4 GB of CAD files, PDF drawings, diagrams, product presentations, specifications, manuals, and instructions, with listed revenue of $7.8 billion.
toa****** - Redacted organization. The listing claims 215 GB of project data, database backups, and logs, with listed revenue of $6.4 billion.
lar****** - Redacted organization. The listing claims 56 GB of project files and software, with listed revenue of $1.7 billion.
sta****** - Redacted organization. The listing claims 3,030 GB of databases and project data, with listed revenue of $939.2 million.
par****** - Redacted organization. The listing claims 24 GB of databases, projects, CAD files, and backups, with listed revenue of $475.7 million.
mam****** - Redacted organization. The listing claims 136 GB of PNG and Windchill files, with listed revenue of $281 million.
cor****** - Redacted organization. The listing claims 3,684 GB of databases, projects, PDFs, TXT files, and DOC files, with listed revenue of $269.8 million.
mam****** - Redacted organization. The listing claims 1.18 GB of databases and project files, with listed revenue of $131 million.
tri****** - Redacted organization. The listing claims 1,579.9 GB of databases and project files, with listed revenue of $1 billion.
sma****** - Redacted organization. The listing claims 6.08 GB of databases and project files, with listed revenue of $113 million.
suu****** - Redacted organization. The listing claims 1,470 GB of databases and project files, with listed revenue of $111 million.
bri****** - Redacted organization. The listing claims 22.4 GB of databases and project files, with listed revenue of $100 million.
jpm****** - Redacted organization. The listing claims 75.4 GB of databases and project files, with listed revenue of $400 million.
clo****** - Redacted organization. The listing claims 651 GB of databases and project files, with listed revenue of $400 million.
ato****** - Redacted organization. The listing claims 980 GB of databases and project files, with listed revenue of $68 million.
hon****** - Redacted organization. The listing claims 1,588 GB of databases and project files, with listed revenue of $470 million.
int****** - Redacted organization. The listing claims 261 GB of databases, projects, PDFs, XLSX, XLS, and DOCX files, with listed revenue of $31 million.
int****** - Redacted organization. The listing claims 271 GB of databases, projects, backups, software installers, updates, and XML files, with listed revenue of $27 million.
gal****** - Redacted organization. The listing claims 382 GB of databases, projects, project backups, and SQL database backups, with listed revenue of $15 million.
β€1
2/2π¨
wat****** - Redacted organization. The listing claims 382 GB of databases, projects, project backups, and SQL database backups, with listed revenue of $5.8 million.
the****** - Redacted organization. The listing claims 285 GB of databases, projects, and software installers, with listed revenue of $9 million.
nuo****** - Redacted organization. The listing claims 279 GB of databases, projects, and software installers, with listed revenue of $6.6 million.
iva****** - Redacted organization. The listing claims 109 GB of databases, projects, and backups, with listed revenue of $8.1 million.
sp****** - Redacted organization. The listing claims 581 GB of databases and projects, with listed revenue of $7.6 million.
lif****** - Redacted organization. The listing claims 168 GB of databases, projects, backups, logs, software installers, PDFs, TXT files, and XML files, with listed revenue of $200 million.
omn****** - Redacted organization. The listing claims 83 GB of databases, projects, SQL backups, software installers, JPEGs, PNGs, and PDFs, with listed revenue of $10 million.
arc****** - Redacted organization. The listing claims 1.84 GB of databases and projects, with listed revenue of under $5 million.
G3A****** - Redacted organization. The listing claims 319 GB of databases and projects, with listed revenue of $1 million.
itk****** - Redacted organization. The listing claims 40.7 GB of databases and projects, with listed revenue of $1.7 billion.
mid****** - Redacted organization. The listing claims 0.5 GB of databases and project data, with listed revenue of $5 million.
flu****** - Redacted organization. The listing claims 26.4 GB of databases, project data, and CAD files, with listed revenue of $5 million.
qc****** - Redacted organization. The listing claims 501 GB of databases and project data, with listed revenue of $5 million.
st****** - Redacted organization. The listing claims 13.2 GB of databases and project data, with listed revenue of $5 million.
ecc****** - Redacted organization. The listing claims 241 GB of DBF files, CAD files, projects, software, and backups, with listed revenue of $5 million.
ipm****** - Redacted organization. The listing claims 253 GB of PDFs, CAD files, and software, with listed revenue of $5 million.
nuv****** - Redacted organization. The listing claims 89.8 GB of project data and software, with listed revenue of $5 million.
wat****** - Redacted organization. The listing claims 382 GB of databases, projects, project backups, and SQL database backups, with listed revenue of $5.8 million.
the****** - Redacted organization. The listing claims 285 GB of databases, projects, and software installers, with listed revenue of $9 million.
nuo****** - Redacted organization. The listing claims 279 GB of databases, projects, and software installers, with listed revenue of $6.6 million.
iva****** - Redacted organization. The listing claims 109 GB of databases, projects, and backups, with listed revenue of $8.1 million.
sp****** - Redacted organization. The listing claims 581 GB of databases and projects, with listed revenue of $7.6 million.
lif****** - Redacted organization. The listing claims 168 GB of databases, projects, backups, logs, software installers, PDFs, TXT files, and XML files, with listed revenue of $200 million.
omn****** - Redacted organization. The listing claims 83 GB of databases, projects, SQL backups, software installers, JPEGs, PNGs, and PDFs, with listed revenue of $10 million.
arc****** - Redacted organization. The listing claims 1.84 GB of databases and projects, with listed revenue of under $5 million.
G3A****** - Redacted organization. The listing claims 319 GB of databases and projects, with listed revenue of $1 million.
itk****** - Redacted organization. The listing claims 40.7 GB of databases and projects, with listed revenue of $1.7 billion.
mid****** - Redacted organization. The listing claims 0.5 GB of databases and project data, with listed revenue of $5 million.
flu****** - Redacted organization. The listing claims 26.4 GB of databases, project data, and CAD files, with listed revenue of $5 million.
qc****** - Redacted organization. The listing claims 501 GB of databases and project data, with listed revenue of $5 million.
st****** - Redacted organization. The listing claims 13.2 GB of databases and project data, with listed revenue of $5 million.
ecc****** - Redacted organization. The listing claims 241 GB of DBF files, CAD files, projects, software, and backups, with listed revenue of $5 million.
ipm****** - Redacted organization. The listing claims 253 GB of PDFs, CAD files, and software, with listed revenue of $5 million.
nuv****** - Redacted organization. The listing claims 89.8 GB of project data and software, with listed revenue of $5 million.
πͺ Slice For Life - Part 2 πͺ
I am in the process of onboarding another 5+ forums, but need to do a little maintenance on the scripts. The forum monitoring status on the threat feed will be updated tomorrow so you know what to look for. Pitch will be completed this weekend. Wamus, if youβ¦
Pitch has been onboarded. Just waiting for a new alert to confirm screenshot. 8 users being checked each cycle. Will be adding more once confirmed everything looks good. Also adding more to Dread.