Critical Security Flaws in WordPress, SonicWall and SharePoint
This week's most significant cybersecurity threats and mitigation strategies.
1Critical WordPress RCE Vulnerability
A newly discovered remote code execution (RCE) vulnerability in WordPress Core targets standard installations without requiring any plugins. Combining CVE-2026-63030 and CVE-2026-60137, this flaw allows anonymous users to execute code. watchTowr reports active exploitation with PoCs already circulating.
2SonicWall SMA Zero-Days
A threat actor dubbed UTA0533 has been exploiting two zero-days (CVE-2026-15409 and CVE-2026-15410) in SonicWall Secure Mobile Access VPN devices since June. Volexity's research reveals custom malware specifically designed for SonicWall SMA appliances being used in attacks.
3OpenSSL DoS Vulnerability
Okta Red Team disclosed HollowByte, a new OpenSSL flaw where just 11 bytes of malicious payload can exhaust server memory before any handshake begins. The OpenSSL team patched this in versions 4.0.1 through 3.0.21, implementing more cautious memory allocation.
4Microsoft SharePoint RCE Flaw
CISA added a critical SharePoint deserialization vulnerability (CVE-2026-58644, CVSS 9.8) to its KEV catalog, requiring federal agencies to patch by July 19. Microsoft confirmed this RCE flaw was exploited as a zero-day before patches were available in this month's record-breaking Patch Tuesday update.
5OkoBot Malware Framework
The new OkoBot framework targets cryptocurrency wallets through fake GitHub repositories. An evolution of TookPS, it includes over 20 malicious modules like the TeviRAT trojan and Rilide browser stealer, capable of harvesting seed phrases, screenshots, and keystrokes across Trezor and Ledger applications.
6Impact of WordPress Vulnerability
With WordPress powering hundreds of millions of sites globally, this vulnerability's potential impact is massive. watchTowr CEO Benjamin Harris notes while some hosts will auto-patch, many sites remain vulnerable, emphasizing the need for backdoor checks alongside immediate patching.
7SonicWall Vulnerability Details
When chained, the SonicWall SMA vulnerabilities (CVE-2026-15409 - CVSS 10.0 and CVE-2026-15410) allow complete device takeover. SonicWall released patches last week for these critical flaws being actively exploited by sophisticated attackers using custom tooling.
8OpenSSL Technical Breakdown
The HollowByte flaw stems from OpenSSL's memory management during handshakes. Attackers trick servers into reserving 128KB for non-existent messages, causing resource exhaustion. Okta explains OpenSSL now allocates memory progressively rather than trusting message headers blindly.
9SharePoint Vulnerability Criticality
Microsoft's SharePoint deserialization flaw (CVE-2026-58644) poses severe risks to enterprises. Its addition to CISA's KEV catalog mandates federal patching by July 19. This was among 622 vulnerabilities fixed in Microsoft's largest-ever Patch Tuesday update.
10OkoBot Infection Methods
OkoBot spreads via GitHub repos masquerading as legitimate software and tools like ClickFix. Its framework includes browser-based Rilide stealer and implants for crypto wallets like TeviRAT, capable of screen capturing and keylogging. Hundreds of victims across 25+ countries have been identified.
11Rise of AI-Powered Attacks
The WordPress vulnerability discovery highlights how AI-assisted security tools can be weaponized. watchTowr notes AI accelerates both vulnerability discovery and exploitation, underscoring the need for defensive AI investments to keep pace with offensive capabilities.
12Key Takeaways
This week's vulnerabilities demonstrate the fragility of critical systems. Flaws in widely-used platforms like WordPress, SonicWall, OpenSSL and SharePoint can impact millions. Experts urge immediate patching and thorough system scans, emphasizing that simple requests can sometimes cause disproportionate damage.
Original article: The Hacker News — WordPress, SonicWall ve SharePoint'te Kritik Güvenlik Açıkları