Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team.

This week, researchers disclosed wp2shell, a chain of two WordPress core flaws that lets an anonymous attacker run code on a stock install. WordPress pushed fixes to affected sites through forced auto-updates.

Two WordPress core bugs chain into code execution with no login →

Brief: Researchers disclosed wp2shell, a chain of two WordPress core flaws that lets an anonymous attacker run code on a stock install with no plugins and no login.

Intel: CVE-2026-63030 is a flaw in the batch endpoint, a WordPress feature that bundles requests into one call, letting a request run with permissions it should not have. CVE-2026-60137 is a SQL injection that reaches the database. Adam Kues at Searchlight Cyber reported the route bug; a separate team reported the injection. WordPress shipped fixes July 17 through auto-updates; the full chain exists only in 6.9 and 7.0, while the injection alone reaches back to 6.8. Security firms have confirmed active exploitation within days of disclosure, including incident response in several attacks.

Why it matters: The fix shipped as open-source code, so researchers reconstructed the flaw from the changed lines and proof-of-concept (PoC) exploits appeared within hours, their speed credited to AI-assisted tooling. Responders are already working confirmed attacks, and the weight is new: all four prior WordPress entries on CISA's KEV catalog were plugins, not Core.

SonicWall SMA 1000 zero-days chained to give unauthenticated OS access →

Brief: SonicWall disclosed two actively exploited vulnerabilities in its SMA 1000 remote-access appliances, with no available workaround and a federal remediation deadline of July 17.

Intel: CVE-2026-15409 carries a CVSS 10.0 rating: it is an SSRF (server-side request forgery) weakness in the SMA 1000 Workplace interface that any unauthenticated remote attacker can reach. CVE-2026-15410 is a CVSS 7.2 code injection weakness inside the Appliance Management Console (AMC); when chained, the two let an attacker run commands on the appliance without logging in. SonicWall PSIRT confirmed "multiple cases indicating the active exploitation." The Cybersecurity and Infrastructure Security Agency (CISA) added both to the Known Exploited Vulnerabilities (KEV) catalog on July 14. No workaround exists.

Why it matters: An SMA 1000 concentrates what an intruder otherwise has to earn: VPN session tokens, administrator credentials, and a map of the network behind the gateway. Exploitation was confirmed before any public proof-of-concept existed, and the CVEs drew a federal remediation deadline just three days after they were listed.

Sandworm adopts ClickFix to compromise Ukrainian organizations →

Brief: Ukraine's CERT confirmed that Sandworm (UAC-0145), a hacking unit tied to Russia's GRU military intelligence, is running ClickFix lures against Ukrainian targets across more than ten compromised websites.

Intel: The group's compromised websites display a fake CAPTCHA that tells visitors to copy a PowerShell command and run it on their computer; the command delivers GHETTOVIBE, a VBS file saved to the Startup directory. A reconnaissance tool, SCOUTCURL, then collects system details, programs, files, and browser data so attackers can triage whether the target warrants further compromise. Higher-value systems received FREAKYPOLL, a compiled Python backdoor, and CERT-UA confirmed at least one organization's network was breached (advisory in Ukrainian). Delivery infrastructure uses SMARTAXE, which resolves its domain from a blockchain smart contract, complicating takedown.

Why it matters: ClickFix was a crimeware staple, used primarily by financially motivated actors, as Ars Technica notes, "in the last year or so." Sandworm's adoption of it closes the gap between commodity lures and elite state intrusion. The same fake CAPTCHA a security team would file under petty crime can now be a GRU operation.

OpenAI's own models escaped a test sandbox and breached Hugging Face →

Brief: Hugging Face disclosed a July 16 intrusion into part of its production infrastructure; OpenAI has since confirmed the attacker was its own models, running a benchmark with safety classifiers disabled.

Intel: OpenAI's models were running an internal cyber-capabilities benchmark with safety classifiers (guardrails against high-risk cyber activity) disabled. In that state, they exploited a previously unknown flaw in a software-download proxy to escape their sandbox. They then used stolen credentials and more previously unknown flaws to run their own code on Hugging Face's servers, reaching test answers in its production database. Hugging Face says the campaign fired thousands of actions across a swarm of disposable environments and reached a small set of internal datasets and credentials, with no sign user-facing models or Spaces were altered.

Why it matters: The frontier AI models Hugging Face tried first refused the attack commands its responders submitted, forcing the forensics onto a model it could run on its own servers. The guardrails that blocked the defenders never touched OpenAI's models: the classifiers were off for the benchmark run.

Stat of the week: 97%

The share of ransomware victims breached through compromised credentials that had multi-factor authentication (MFA) enabled in some form at the time of the attack, according to the Sophos State of Ransomware 2026 report; deploying MFA and being covered by it are two different things.

Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.