Weekly Threat Awareness ReportSharePoint RCE in KEV · WordPress "wp2shell" · YellowKey BitLocker Bypass
Three critical, actively exploited flaws lead this week, all in software your clients run every day: an unauthenticated SharePoint remote code execution already in the CISA KEV catalog, a WordPress Core "wp2shell" chain that takes over a stock install with no plugin or login required, and the "YellowKey" BitLocker bypass that reaches encrypted data on a stolen device. On the campaign side, the TWINLOOT implant hides its entire command-and-control inside trusted Microsoft cloud services, and a China-nexus APT is mass-exploiting a VMware vCenter directory-traversal flaw across 47 countries. The through-line: patching is necessary but not sufficient - trusted platforms and post-patch persistence are where this week's risk lives.
Vaughn Thomas
Compliance Engineer & Threat Researcher · SOClogix Cyber Group
Technical review: William Johnson, VP of Security Operations
About the Analyst
Vaughn Thomas is SOClogix's Compliance Engineer and principal threat researcher, operating at the intersection of regulatory compliance and active adversary tradecraft. Each week, Vaughn synthesizes intelligence from dark web forums, vendor security advisories, CISA KEV updates, Shodan/Censys exposure data, and real-time telemetry from SOClogix's managed client network - spanning healthcare, financial services, defense industrial base, manufacturing, and local government - to produce actionable threat awareness briefings written for security teams and executive stakeholders at every level. Vaughn actively tracks over 200 threat actor groups and contributes threat sharing intelligence to multiple ISAC communities. His analysis deliberately bridges raw technical findings and business risk so compliance teams and CISOs can act, not just read.
Full bio and published research LinkedIn200+
Threat groups tracked
50+
Intel feeds monitored
3 yrs
Threat research tenure
This Week's Client-Facing CVEs by Severity
The three client-facing vulnerabilities covered this week, ranked by CVSS base score. Two are in the CISA KEV catalog and under active exploitation; the third has public proof-of-concept code and requires physical access.
CVE-2026-50522CVE-2026-63030CVE-2026-45585Vulnerabilities at a Glance
Exploitation status and required action for each CVE covered this week, including the VMware vCenter flaw driving the active campaign below.
| CVE | Product | CVSS | Exploitation Status | Fix | Priority |
|---|---|---|---|---|---|
CVE-2026-50522 | SharePoint Server (on-premises) | 9.8 | Active - CISA KEV; machine-key theft | Jul 2026 update + key rotation | URGENT |
CVE-2026-59310 | VMware vCenter (Syslog server) | 9.8 | Active - global APT campaign | VMSA-2026-0006 (no workaround) | URGENT |
CVE-2026-63030 | WordPress Core 6.9.0-6.9.4, 7.0.0-7.0.1 | 9.8 | Active - CISA KEV ("wp2shell" chain) | 6.9.5 / 7.0.2 | URGENT |
CVE-2026-45585 | Windows BitLocker / WinRE ("YellowKey") | 6.8 | Public PoC; physical access required | Jun 2026 update | This cycle |
CVEs Affecting Client Assets
Vulnerabilities identified this week with direct relevance to common enterprise environments. Two are in the CISA KEV catalog and under active exploitation.
CVE-2026-50522 New this week Actively exploited CISA KEVMicrosoft SharePoint Server - Remote Code Execution
Insecure Deserialization (CWE-502) · Unauthenticated · Remote · In CISA KEV
A critical deserialization flaw in on-premises SharePoint Server lets an unauthenticated attacker run commands on the server without valid credentials. The software blindly trusts data provided by an external source, so a malicious actor can inject and execute unauthorized code. Successful exploitation grants complete control of the compromised server, opening the door to data theft, ransomware, and lateral movement deeper into the corporate network. Active exploitation began within hours of public proof-of-concept code appearing on July 20, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on July 22. Multiple APT groups, including Lazarus Group and Mustang Panda, are associated with or monitoring the exploit, and the circulating PoC has driven significant social-media attention that raises the odds of widespread attacks. Critically, attackers are using this flaw to steal SharePoint IIS machine keys - cryptographic material that lets them forge authentication tokens and retain access even after the server is patched.
Recommended Actions
- Apply the July 2026 SharePoint security updates immediately across SharePoint 2016, 2019, and Subscription Edition (SharePoint Online is hosted and patched by Microsoft)
- Rotate ASP.NET machine keys and any credentials on potentially exposed servers - patching alone does not evict an attacker holding stolen keys
- Hunt for compromise: anomalous requests to sign-in endpoints, unfamiliar web files, and unexpected persistence mechanisms
- Add monitoring for suspicious network activity that could indicate an attempted or successful compromise
CVE-2026-63030 New this week Actively exploited CISA KEVWordPress Core "wp2shell" - Pre-Auth Remote Code Execution
Route Confusion (CWE-436) chained with SQL injection (CVE-2026-60137) · Unauthenticated · Remote · In CISA KEV
A high-severity flaw in the WordPress REST API batch endpoint - the feature WordPress uses to process multiple requests at once - lets an attacker take complete control of a site. The root cause is a route-confusion issue that, chained with a SQL injection bug, allows an unauthenticated user to manipulate database queries, bypass standard security checks, and trick the system into running harmful commands. The result is full remote code execution against a stock WordPress install - no plugins, no login, and no user interaction required. Site owners face total data loss, malicious content injected into their pages, or visitors redirected to dangerous websites, with the reputational and legal fallout that follows. Exploitation is confirmed in the wild, dozens of proof-of-concept exploits are circulating (including some built to bypass web application firewalls), the CVE is tracked by the APT group "Operation Talked", and it has been added to the CISA KEV catalog.
Recommended Actions
- Update to WordPress 6.9.5 or 7.0.2 (or later) - because this is a core flaw, disabling plugins does not help
- Verify the installed version on every site rather than assuming: WordPress force-pushed automatic updates, but forced updates fail silently on some hosts
- If patching is delayed, block the /wp-json/batch/v1 endpoint at the WAF
- Review access logs for POST requests to the batch endpoint and any use of the author_exclude parameter, and inspect web roots for unfamiliar PHP files
CVE-2026-45585 New this week Public PoCWindows BitLocker Security-Feature Bypass ("YellowKey")
Protection Mechanism Failure (CWE-693) · Requires physical access · Public PoC
Microsoft has confirmed a security-feature bypass nicknamed "YellowKey" that lets an attacker circumvent certain Windows protections guarding data at rest. An attacker with physical possession of a device can bypass the safeguards intended to keep data encrypted and reach protected files. The encryption itself is not broken - the trust chain around Windows recovery is. Organizations whose employees travel or work remotely carry the highest risk, since those devices are most exposed to theft or unauthorized handling. Public proof-of-concept code has been released, which violates standard disclosure practice and makes exploitation straightforward for anyone holding a stolen or unattended device. No APT groups have been linked to it, but the wide availability of exploit code raises the risk of misuse. Devices configured with a TPM+PIN unlock are already protected and are not affected by this specific flaw.
Recommended Actions
- Confirm the June 2026 security update is deployed across the fleet, with priority on laptops and other devices that travel
- Where the earlier interim mitigation script was applied, verify the permanent update has superseded it
- Enforce TPM+PIN via Group Policy or Intune on high-risk mobile devices - it defeats this entire class of physical-access bypass
- For any device lost or stolen before patching, treat its stored data as potentially exposed and respond accordingly
Active Threats & Campaigns
Threat actor activity and disclosed tradecraft with immediate defensive relevance.
TWINLOOT - Command-and-Control Hidden Across Microsoft Cloud Services
TWINLOOT is a modular, PyArmor-hardened Python implant framework the Ontinue Cyber Defense Center discovered while investigating an active intrusion in July 2026. Its defining trait is that the entire command-and-control infrastructure runs inside trusted Microsoft services, so malicious activity is indistinguishable from routine Microsoft 365 traffic. The operator converts everyday M365 activity into a covert control plane for long-dwell intrusion, credential theft, and hands-on-keyboard lateral movement, culminating - based on STAC4749 overlaps - in Chaos ransomware deployment. Observed capabilities include credential theft through a fake Windows lock screen, tunneled internal network access over reverse SOCKS5 (reaching RDP, SMB, and WinRM), and arbitrary command execution. The strategic impact is the erosion of trust boundaries around Microsoft cloud telemetry: because C2 rides SharePoint, Teams TURN traffic, and same-origin Graph fetches from the user's own Edge browser, most cloud-monitoring tools have no anomaly to flag. Ontinue notes operational parallels with STAC4749, a financially motivated cluster tracked by Sophos and active February to June 2026 (Teams vishing delivery, a PyArmor-obfuscated Python backdoor, reverse SOCKS5 proxying, HKCU Run Key persistence, and Chaos ransomware, with a possible Russian-language connection from keyboard artifacts). Formal attribution is not established - the overlap is treated as an unverified hypothesis.
Recommended Actions
- Alert on newly registered or newly consented Entra ID applications and unusual Graph API access patterns
- Monitor for reverse SOCKS5 tunneling behavior and unexpected outbound TURN sessions from non-Teams processes
- Treat Teams-based vishing as a live initial-access vector in user awareness training
- Baseline PowerShell and Python execution on endpoints where neither is routine
Threat Profile
Source: Ontinue Cyber Defense Center
Type: Modular PyArmor-hardened Python implant
C2 channels: SharePoint, Teams TURN, browser Graph API
Persistence: Previously unseen offline-registry-hive primitive
Overlap: STAC4749 (Sophos), financially motivated
Endgame: Chaos ransomware (attribution unverified)
VMware vCenter Global Exploitation - CVE-2026-59310
A China-nexus APT exploited CVE-2026-59310, a critical VMware vCenter directory-traversal vulnerability, deploying the linuxFile backdoor, a JSP web shell, reverse SSH tunnels, and Babuk-derived ransomware against ESXi hosts. QUIRSO attributed the campaign with moderate confidence to a UTC+08:00 threat actor and identified 361 victim IP addresses across 47 countries. vCenter compromise is a worst-case foothold: it hands the attacker the management plane for the entire virtual estate, including the ESXi hosts running backups and domain controllers. Organizations should put this near the top of the queue if they run internet-reachable or broadly reachable vCenter deployments, especially where the Syslog Server component can be reached from untrusted networks.
Recommended Actions
- Apply VMSA-2026-0006 to all vCenter deployments immediately - Broadcom offers no workaround, so patching is the only remediation
- Restrict network access to vCenter and the Syslog component to management VLANs only
- For any instance exposed during the window, hunt for compromise: review cron entries and unfamiliar files on the appliance and look for outbound SSH to unknown hosts
- Audit for administrative accounts created since late July
Campaign Profile
Source: QUIRSO
Actor: China-nexus, UTC+08:00 (moderate confidence)
CVE: CVE-2026-59310 (directory traversal)
Tooling: linuxFile backdoor, JSP web shell, reverse SSH
Ransomware: Babuk-derived, targeting ESXi
Scope: 361 victim IPs across 47 countries
Sources
Primary reporting behind this week's briefing.
- · Microsoft Security Update Guide - CVE-2026-50522
- · CISA Known Exploited Vulnerabilities Catalog
- · WordPress Security Advisory - wp2shell (GHSA-ff9f-jf42-662q)
- · Microsoft Security Update Guide - CVE-2026-45585 (YellowKey)
- · Broadcom VMSA-2026-0006 - vCenter security advisory
- · Ontinue Cyber Defense Center - TWINLOOT research
- · QUIRSO - vCenter exploitation campaign research
Protect your environment
Vaughn Thomas
Compliance Engineer & Threat Researcher, SOClogix
Technical review: William Johnson, VP of Security Operations
Vaughn Thomas
Compliance Engineer
SOClogix Cyber Group
200+
Threat groups tracked
50+
Intel feeds monitored
52×
Reports per year
Get Weekly Briefings Free
This Week at a Glance
Past Briefings
Jul 23, 2026
Defender "BlueHammer" in KEV · Qilin Chains PAN-OS Bypass · 1.4M Sites Targeted
Jul 16, 2026
SMA1000 SSRF at CVSS 10 in KEV · AD FS Privilege Escalation · BitLocker Bypass
Jul 9, 2026
FortiWeb Auth Bypass in KEV · Windows .LNK Spoofing · Jade Puffer AI Ransomware
Get Vaughn's Briefing Every Week
Free weekly threat awareness reports delivered to your inbox. CVEs, active campaigns, and actionable guidance - written for security teams, compliance managers, and executive stakeholders.
Questions about your exposure to anything in this report? SOClogix Shield MDR clients receive proactive detection coverage and patch-priority guidance for the threats above. Talk to our team to schedule a consultation.