# Threat Intel Brief — July 19, 2026

TL;DR

  • WordPress Core RCE: Critical unauthenticated remote code execution vulnerabilities ("wp2shell") in WordPress 6.9–7.0 now have public exploits; forced auto-updates deployed, but manual verification essential.
  • DigiCert Supply Chain Breach: Chinese APT subgroup CylindricalCanine (GoldenEyeDog/APT-Q-27) stole code-signing certificates from DigiCert in April 2026, enabling attackers to sign malware as legitimate software.
  • AI Infrastructure at Risk: NadMesh botnet actively harvests AWS keys and Kubernetes tokens from exposed AI services; operator dashboard reports over 3,800 compromised AWS credentials.
  • OpenSSL DoS Vulnerability: HollowByte flaw allows 11-byte TLS requests to exhaust server memory; patched silently in June 2024 without public disclosure.
  • npm Supply Chain Attack: Seven malicious packages targeting Vite frontend developers deliver RAT malware via blockchain-based command-and-control infrastructure.

---

Critical Threats

WordPress Core "wp2shell" Remote Code Execution

What happened
Critical unauthenticated remote code execution vulnerabilities were discovered in WordPress Core versions 6.9.0–6.9.4 and 7.0.0–7.0.1. The flaws allow anonymous HTTP requests to execute arbitrary code on vulnerable sites without authentication. WordPress released emergency patches (6.9.5 and 7.0.2) with forced auto-updates enabled. Public exploit code is now available, significantly lowering the barrier to exploitation.

Impact
WordPress powers approximately 43% of all websites globally. Successful exploitation grants attackers complete control over vulnerable sites, enabling data theft, malware distribution, defacement, and potential lateral movement to backend infrastructure. While forced auto-updates mitigate risk for default configurations, sites with disabled auto-updates or custom update policies remain critically exposed. Public exploit availability makes mass exploitation campaigns highly probable within days.

Recommendations

  • Verify all WordPress installations are running 6.9.5 or 7.0.2 immediately via wp-admin dashboard or WP-CLI (wp core update).
  • Audit sites with disabled auto-updates or managed hosting configurations; manually patch if necessary.
  • Review web server access logs for unusual POST/GET requests to WordPress core endpoints from unauthenticated sources over the past 72 hours.
  • Inspect WordPress installations for indicators of compromise: unexpected administrator accounts, modified core files, webshells in wp-content/uploads or wp-includes directories.
  • Deploy temporary WAF rules blocking suspicious unauthenticated requests to WordPress core endpoints if patching is delayed.

---

DigiCert Certificate Authority Breach

What happened
Security researchers attributed the April 2026 DigiCert security incident to CylindricalCanine, a subgroup of the Chinese threat actor GoldenEyeDog (also tracked as APT-Q-27). The breach resulted in the theft of code-signing certificates from DigiCert's infrastructure. Code-signing certificates are cryptographic credentials used to verify the authenticity and integrity of software; their compromise enables attackers to sign malicious code that appears legitimate to security controls and end users.

Impact
This represents a critical supply chain compromise affecting the global software trust ecosystem. Stolen code-signing certificates allow attackers to bypass application whitelisting, endpoint protection, and user trust mechanisms by signing malware as if it were legitimate software from trusted publishers. Organizations cannot distinguish between genuinely signed software and attacker-signed malware without certificate revocation and reissuance. The incident undermines public key infrastructure (PKI) integrity and creates systemic risk across all sectors relying on DigiCert-issued certificates.

Recommendations

  • Identify all software and executables signed with DigiCert code-signing certificates issued before May 2026 in your environment using inventory tools or certificate inspection utilities.
  • Monitor DigiCert security advisories and certificate revocation lists (CRLs) for specific affected certificate serial numbers; replace compromised certificates immediately upon identification.
  • Enable and verify Certificate Revocation List (CRL) and Online Certificate Status Protocol (OCSP) checking on all endpoints, application trust stores, and code-signing verification systems.
  • Review security logs and EDR telemetry for unexpected code-signed binaries, especially those signed with DigiCert certificates during or after April 2026; investigate anomalous execution patterns.
  • Implement additional runtime behavioral monitoring and EDR alerting for signed executables until certificate rotation is complete; focus on process injection, network callbacks, and privilege escalation attempts.
  • Coordinate with software vendors using DigiCert certificates to confirm their signing certificates were not compromised and obtain re-signed versions if necessary.

---

NadMesh Botnet Targeting AI Infrastructure

What happened
A Go-based botnet designated NadMesh was discovered in early July actively scanning for and compromising exposed AI and automation services including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. The botnet uses automated Shodan scanning to identify vulnerable targets and harvests AWS access keys and Kubernetes authentication tokens from compromised systems. The operator maintains a centralized dashboard tracking stolen credentials, which currently reports 3,811 unique AWS keys compromised.

Impact
Stolen AWS credentials and Kubernetes tokens enable attackers to access cloud resources, deploy cryptocurrency miners, exfiltrate data, pivot to internal networks, and conduct further supply chain attacks. The targeting of AI services exploits the rapid adoption of AI infrastructure where security hardening often lags behind deployment speed, particularly in development and testing environments. Organizations with internet-exposed AI services face immediate risk of credential theft and cloud resource abuse.

Recommendations

  • Implement network segmentation to prevent AI services from being directly exposed to the internet; require VPN or zero-trust network access for remote administration.
  • Enable AWS CloudTrail and monitor for anomalous API calls using potentially compromised credentials, particularly from unexpected geographic locations or IP addresses.
  • Rotate all AWS access keys and Kubernetes tokens for systems running targeted AI services immediately; transition to short-lived credentials using IAM roles or Kubernetes service accounts instead of static keys.
  • Deploy detection rules for Shodan and mass-scanning activity targeting AI service ports (monitor firewall logs for reconnaissance patterns).
  • Audit configuration files, environment variables, and container images in AI service deployments to ensure credentials are not stored in plaintext; migrate to secrets management solutions like AWS Secrets Manager or HashiCorp Vault.

---

Threat Actor Activity

GoldenEyeDog (APT-Q-27) / CylindricalCanine

The DigiCert breach attribution to CylindricalCanine—a subgroup of GoldenEyeDog (APT-Q-27)—represents a significant escalation for this Chinese threat actor. Historically focused on gambling and gaming sectors for financial gain, the pivot to certificate authority infrastructure demonstrates advanced tradecraft and strategic planning. The theft of code-signing certificates enables downstream attacks across any industry, effectively multiplying the group's attack surface beyond direct sector targeting. This incident follows broader trends of sophisticated actors targeting software supply chain trust mechanisms, similar to historical compromises involving other APT groups. The emergence of the CylindricalCanine subgroup designation suggests operational compartmentalization or distinct tooling for high-value supply chain operations.

ChainVeil

ChainVeil is conducting software supply chain attacks against the npm ecosystem through the ViteVenom campaign, which distributes seven malicious packages masquerading as legitimate Vite frontend tooling. The actor demonstrates technical sophistication through blockchain-based command-and-control infrastructure, providing resilience against traditional takedown efforts and domain-based blocking. The campaign targets software developers to establish persistent remote access to development environments, likely for intellectual property theft, credential harvesting, or further supply chain compromise. The narrow focus on Vite users indicates either opportunistic exploitation of a growing ecosystem or deliberate targeting of organizations using modern JavaScript toolchains.

NadMesh

NadMesh operates a structured credential harvesting operation targeting cloud infrastructure through exploitation of exposed AI and automation services. The threat actor uses automated Shodan scanning to identify vulnerable targets at scale, with a centralized dashboard tracking compromised credentials. The operation demonstrates capabilities in credential access and collection, with over 3,800 unique AWS keys reported compromised within the initial discovery period. The focus on AI services positions NadMesh within the evolving landscape of threats targeting machine learning operations (MLOps) and AI development environments where security controls may lag behind rapid deployment cycles.

---

Geopolitical Context

The DigiCert breach carries significant implications for global digital trust infrastructure and may strain diplomatic and cybersecurity cooperation if attribution to China-linked actors gains traction among allied governments. In North America and Europe, the incident will likely accelerate regulatory scrutiny of certificate authorities and supply chain security standards, particularly under frameworks such as the EU's NIS2 Directive and U.S. cyber incident reporting requirements. The compromise undermines confidence in public key infrastructure (PKI) and may prompt enterprises to adopt zero-trust architectures and enhanced software verification protocols. Countries with robust gaming and gambling industries—including the Philippines, Macau, and Singapore—may face heightened risk if stolen certificates are weaponized for targeted intrusions. The incident reinforces concerns about the concentration of trust in a small number of certificate authorities and the systemic risk posed by their compromise.

---

Recommended Actions

Immediate (0–24 hours)

  • WordPress: Verify all WordPress sites are patched to 6.9.5 or 7.0.2; audit for signs of compromise.
  • DigiCert: Identify software signed with DigiCert certificates issued before May 2026; monitor for revocation notices.
  • NadMesh: Rotate AWS keys and Kubernetes tokens for systems running ComfyUI, Ollama, n8n, Open WebUI, Langflow, or Gradio.
  • 7-Zip: Update to version 26.02 on all endpoints and servers.
  • OpenSSL: Update to versions released after June 2024 on glibc-based Linux systems; implement rate limiting on TLS endpoints.

Short-term (24–72 hours)

  • npm/Vite: Audit all npm dependencies in Vite projects against Checkmarx ViteVenom IOCs; scan developer workstations for RAT indicators.
  • ACR Stealer: Deploy endpoint detection rules for ACR Stealer IOCs; audit browser-based password storage policies.
  • DigiCert: Enable CRL/OCSP checking on all endpoints; review logs for unexpected code-signed binaries.
  • AI Services: Implement network segmentation for AI infrastructure; deploy secrets management solutions.

This week

  • Supply Chain: Implement npm package integrity verification using lock files and audit tools; establish baseline behavior for build processes.
  • Certificate Monitoring: Deploy certificate transparency monitoring to detect unauthorized issuance or use of code-signing certificates.
  • Cloud Security: Enable AWS CloudTrail monitoring for anomalous API calls; implement short-lived credentials across cloud environments.
  • Incident Response: Review and test incident response procedures for supply chain compromise scenarios.

---

Watch List

  • Abbott Laboratories: Investigating two separate cybersecurity incidents involving unauthorized access to legacy Exact Sciences systems and alleged LabCentral portal breach; monitor for additional disclosures.
  • Ernst & Young: Data breach resulting from compromise of third-party support ticket system; customer data exposed through unauthorized access to IT support infrastructure.
  • OpenSSL HollowByte: Monitor for CVE assignment and detailed affected version information; vulnerability patched in June 2024 without public advisory.
  • 7-Zip RCE: CVE not yet publicly assigned; monitor for public proof-of-concept exploits and additional technical details.
  • ACR Stealer: Microsoft reports surge in attacks; monitor for updated IOCs and detection guidance from Microsoft Threat Intelligence.

---

Sources

  • BleepingComputer: Update now: 7-Zip fixes RCE flaw exploitable with malicious archives
  • BleepingComputer: WordPress Core "wp2shell" RCE flaws get public exploits, patch now
  • BleepingComputer: Microsoft warns of surge in ACR Stealer attacks on customers
  • BleepingComputer: Abbott probes two cyber incidents amid extortion claims
  • BleepingComputer: HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload
  • BleepingComputer: Ernst & Young discloses data breach after support system hack
  • The Hacker News: New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
  • The Hacker News: OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests
  • The Hacker News: Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT
  • The Hacker News: New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens
  • The Hacker News: GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft