KEVIntel

@HackingLZ And everyone who didn’t land it saying their solution would have found it… like yea, with hindsight our cat could have found it

The fun thing about the latest WordPress RCE is knowing everyone has been running bug hunting harnesses with every model imaginable against the same code for months and one person still landed it. So much for the space being dead.

Friday. Your answer is Friday... You maniacs!

We’re seeing this AI-slop "PoC" scanning our FortiSandbox sensors: github.com/0xBlackash/CVE… A request hitting a sensor does not automatically equal real exploitation. This activity will not be classified as exploitation or added as a KEV by KEVIntel.

Guys. Listen. Listen! We don't need anymore wp2shell PoCs. You can stop asking AI to create them now. There's enough to go around.

Dust off your forum signature. phpBB exploitation is back! Over the weekend, KEVIntel detected in-the-wild exploitation attempts targeting CVE-2026-48611, a phpBB authentication bypass. The scale of activity currently appears limited, but a public Nuclei template is available.

What’s the best day for you all to release a WordPress Core RCE?

We have released Virtual Patches and Private PoC to our Enterprise customers for wp2shell. CVE-2026-63030 kevintel.com/CVE-2026-63030

CVE-2026-46442 is hitting KEVIntel’s Flowise sensor. First seen July 13, with attempts increasing: 20 from 7 attacker IPs. The odd part? It’s an authenticated RCE, but attackers are running the exploit unauthenticated. Now in our KEV Feed: kevintel.com/CVE-2026-46442

Here’s the Age of Empires RCE from yesterday’s Patch Tuesday: CVE-2026-50663. Join an attacker’s lobby, (auto-)accept UCG, and you get remote code execution.

The vulnerability can be exploited remotely without authentication or user interaction. CVSS Score: 10.0 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CWE-918: Server-Side Request Forgery (SSRF) SonicWall advisory: psirt.global.sonicwall.com/vuln-detail/SN…

🚨 Critical SonicWall SMA1000 flaw exploited in the wild. CVE-2026-15409 is a pre-auth SSRF rated CVSS 10.0. The CVE record is not yet public. Running SMA1000? Patch now: • 12.4.3-03453+ • 12.5.0-02835+ KEVIntel sensors have not observed exploitation so far.

kevintel.com/CVE-2026-56155 kevintel.com/CVE-2026-56164

Microsoft has patched two vulnerabilities exploited in the wild in July’s Patch Tuesday release: • CVE-2026-56164 • CVE-2026-56155 Both are now tracked in the KEVIntel feed.

New in KEVIntel: Observed Attackers and Attacker IP Profiles. See which IPs are most active, which CVEs each IP is targeting, and the activity behind every profile. Export attacker IPs as CSV for blocklist and enrichment workflows. Product demo 👇

Anyone want to help this guy escape from Belarus? 😬 Captured by KEVIntel sensors.

A KEVIntel Virtual Patch for CVE-2026-2699 is now available for teams that need time before shutting down affected servers. We are actively monitoring for exploitation, suspicious activity and signs of a possible 0-day.

This morning, we added CVE-2026-2699 to the KEVIntel KEV Feed based on partner intelligence. It is an authentication bypass with public PoCs. We have not observed exploitation in our global sensor network and cannot link it to the ShareFile reports.

⚠️ The vulnerability behind reported Progress ShareFile SZC exploitation remains unknown. Yesterday, KEVIntel alerted subscribers to credible reports of active exploitation. No CVE was attributed, and a 0-day remains possible.