7 articles · newest first
A researcher found a way to turn a page number into a working PHP shell — no login required. vBulletin patched it in July. A lot of self-hosted forums haven't.
Priya Nair · Jul 31 · 7 min
The exploit hinges on a subtle mistake — WordPress's REST API validates and executes batch requests in two separate loops. When one step fails, everything after it dispatches under the wrong handler. Here's the chain, step by step.
Priya Nair · Jul 22 · 9 min
It's the nickname for a critical flaw in WordPress core — two vulnerabilities chained into a full site takeover with no login required. Here's what it is, whether you're affected, and what to do, in plain English.
Priya Nair · Jul 22 · 9 min
If your WordPress lives on managed hosting, you were probably patched before you'd even read the news. The sites actually exposed to wp2shell share a specific setup — here's whether yours is one of them.
Priya Nair · Jul 22 · 8 min
Clicking 'update' closes the door. It doesn't check whether someone already walked through it, or whether the other doors are locked. A practical, no-nonsense checklist for after a critical WordPress vulnerability.
Priya Nair · Jul 22 · 9 min
Most WordPress vulnerabilities live in plugins and themes you can uninstall. A flaw in core itself — reachable on a default install with no add-ons — is a different, rarer animal. The data on why wp2shell stands out.
Priya Nair · Jul 22 · 8 min
The forced auto-update push behind the wp2shell fix is a mechanism WordPress has used only a handful of times. What it is, why they broke the 'we don't touch your site' rule, and how to confirm your install actually got it.
Priya Nair · Jul 22 · 8 min