CVEasy Weekly

This Week in Exposure

Week 30 · July 14 to July 20, 2026

This week the exposure was not a weak password or a missing patch. It was trust behaving exactly as designed. WordPress core shipped a batch route that quietly slid an anonymous request onto the handler behind it, and that handler runs on close to half the web. A SonicWall appliance whose whole job is to guard the perimeter took an encoded URL and handed back root. And four npm packages arrived in build pipelines carrying a cryptographically valid signature over a backdoor. The common thread is uncomfortable: a valid signature, a trusted core, and a hardened appliance were the attack surface.

Here is what mattered, ranked by real risk, not just CVSS.

Top Exposures This Week

1. WordPress wp2shell: anonymous RCE on 43% of the web

CVE-2026-63030 + CVE-2026-60137 · WordPress core 6.9 and 7.0

The REST batch route handler pushed a WP_Error onto the validation array but not onto the matches array, sliding sub-request i onto handler i+1 and dropping an anonymous request straight onto the WP_Query author__not_in SQL injection sitting behind it. Two CVEs, one chain, and the result is a pre-auth shell with no login event at all. WordPress shipped 6.9.5 and 7.0.2 as an emergency release on Friday July 17 and flipped the built-in forced auto-update on.

Risk read: This is the widest blast radius of the week, because the affected code ships to close to half the web. By Sunday morning the researchers at Hexastrike reported honeypot hits, live incident response engagements, and a public proof-of-concept on GitHub named wp2shell. That combination, unauthenticated plus a working public exploit plus confirmed activity, puts it in the top exploitation tier. The catch TRIS surfaces: a site behind an SSO reverse proxy with no public /wp-json/ is not the same finding as an unauthenticated site with the REST API open to the internet, and a CVSS-first queue flattens both into one. The real question is whether your specific box was on 6.9 or 7.0 with auto-updates off over the weekend.

Read the TRIS walk →

2. SonicWall SMA1000: an encoded URL to unauthenticated root

CVE-2026-15409 + CVE-2026-15410 · SonicWall SMA1000 (Workplace, AMC)

CVE-2026-15409 is a CVSS 10.0 server-side request forgery in the SMA1000 Workplace interface. Encoded URLs let an outside request reach the internal Appliance Management Console, where CVE-2026-15410, a post-auth code injection, finishes the job. Chained, they turn an internet-facing secure remote access box into an unauthenticated root shell. The appliance that terminates your VPN tunnels and enforces your MFA is the one being turned inside out.

Risk read: SonicWall confirmed active exploitation and CISA added both CVEs to the Known Exploited Vulnerabilities catalog on July 14, with Binding Operational Directive 26-04 giving federal agencies until July 17 to patch or take the boxes offline, a deadline that has now passed. TRIS keeps a proven attacker chain in the wild above a mere public proof-of-concept, and this is the former: confirmed abuse against real customers. The exposure is total, because root on the perimeter appliance is root on the thing that vouches for every session behind it. Patch to the fixed SMA1000 build, then hunt for AMC changes and rotate anything the appliance could reach.

Read the full chain →

3. AsyncAPI npm: a backdoor with a valid seal

Supply-chain compromise · four @asyncapi npm packages

One pull request against the AsyncAPI generator repository was turned into four backdoored npm packages: @asyncapi/specs, @asyncapi/generator, @asyncapi/generator-components, and a companion generator package. Every tarball carried a cryptographically valid SLSA attestation, the correct maintainer, and the exact GitHub Actions workflow you would expect. Any CI pipeline that ran npm install of the AsyncAPI generator between 07:10 and 11:18 UTC on July 14 pulled a tarball whose index.js spawned a child process reading environment variables. The line that mattered signed the attacker's work with the same key it signs the maintainer's.

Risk read: The reach is 3 million weekly downloads, but the window was narrow and the packages have been pulled, so exposure is scoped to who installed inside that morning. The second stage is a Miasma-family payload analysts have tracked across several npm and PyPI operations this year: a credential harvester and command-and-control fallbacks over Nostr and libp2p rather than plain HTTPS. The exposure TRIS flags here is conceptual and expensive to miss: provenance proves where a package was built, not that its contents are safe. A green signature is not integrity when the signing key signs whatever the pipeline produces. Audit installs in that window, rotate CI secrets that were in scope, and pin to a known-good version.

Read the provenance breakdown →

Threat Actor Spotlight

The WordPress and SonicWall activity this week reads as opportunistic mass exploitation of freshly public bugs, and I am not going to attach a crew name to a honeypot probe. The one thread with genuine tracked reporting behind it is the Miasma malware family in the AsyncAPI compromise. Analysts have followed this lineage through several npm and PyPI operations this year, and its signature is consistent: a credential harvester paired with command-and-control that falls back to Nostr and libp2p instead of plain HTTPS, which is what lets it survive when defenders block the obvious domains. What makes this campaign instructive is where it struck. It did not phish a maintainer at the end of the lifecycle, it entered through a pull request and let the trusted publishing pipeline sign the payload for it. Hardening takeaway: treat provenance as proof of origin, not proof of intent. Pin dependencies to reviewed versions, gate what a pull request from outside can trigger in CI, and rotate any secret a build pipeline could have read, rather than trusting that a valid signature closed the question.

Signed CVEasy threat-intel IOC bundle current as of 2026-07-20. The desktop app verifies the ED25519 signature before import.

Every item this week was a thing you were supposed to trust. The core that runs your site, the appliance that guards your network, the signature on your dependency. Trust is not the same as integrity, and a scanner queue cannot tell you which of your boxes actually had auto-updates off, still exposes the SMA Workplace endpoint, or pulled that tarball inside the window. Two servers with the same advisory belong in different queues, and the one that ranks itself on your real exposure is the one worth your Monday. That is the gap TRIS exists to close, and the gap I want this letter to close for you every week.

Patch well,
Chris Boker
Founder, CVEasy AI