8 articles · newest first
A researcher found a way to turn a page number into a working PHP shell — no login required. vBulletin patched it in July. A lot of self-hosted forums haven't.
Kernel · Jul 31 · 7 min
The exploit hinges on a subtle mistake — WordPress's REST API validates and executes batch requests in two separate loops. When one step fails, everything after it dispatches under the wrong handler. Here's the chain, step by step.
Kernel · Jul 22 · 9 min
It's the nickname for a critical flaw in WordPress core — two vulnerabilities chained into a full site takeover with no login required. Here's what it is, whether you're affected, and what to do, in plain English.
Kernel · Jul 22 · 9 min
If your WordPress lives on managed hosting, you were probably patched before you'd even read the news. The sites actually exposed to wp2shell share a specific setup — here's whether yours is one of them.
Kernel · Jul 22 · 8 min
Clicking 'update' closes the door. It doesn't check whether someone already walked through it, or whether the other doors are locked. A practical, no-nonsense checklist for after a critical WordPress vulnerability.
Kernel · Jul 22 · 9 min
Most WordPress vulnerabilities live in plugins and themes you can uninstall. A flaw in core itself — reachable on a default install with no add-ons — is a different, rarer animal. The data on why wp2shell stands out.
Kernel · Jul 22 · 8 min
The forced auto-update push behind the wp2shell fix is a mechanism WordPress has used only a handful of times. What it is, why they broke the 'we don't touch your site' rule, and how to confirm your install actually got it.
Kernel · Jul 22 · 8 min
No login, no plugin, no odd setup. One anonymous request could take over a default WordPress site. Here is the official advisory in plain English, the fixed versions, and the leftovers that tell you a site was hit.
Kernel · Jul 18 · 6 min