Inside wp2shell: How Two WordPress Core Bugs Became a Critical RCE Chain
Blog Analyzing CVE-2026-63030 and CVE-2026-60137 When WordPress quietly pushed emergency security updates on July 17, 2026, it wasn’t addressing just another isolated vulnerability. Instead, the patches closed two separate flaws that, when chained together, created something far more serious than either issue on its own. Researchers quickly began referring to the attack chain as wp2shell a […]