Cyber Security News

Hacking Editorial Brief — July 19, 2026

WordPress wp2shell Exploits Released, OpenSSL Patches HollowByte Without Advisory

Security researchers published working exploit code targeting two WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030, collectively dubbed wp2shell. The exploits enable attackers to achieve remote code execution and take full control of vulnerable WordPress installations. Details remain limited on the affected versions and exploitation requirements, but the public release of functional exploit code significantly accelerates the threat timeline for unpatched sites. Separately, OpenSSL maintainers quietly patched the HollowByte memory exhaustion vulnerability disclosed yesterday, continuing their controversial practice of releasing security fixes without CVE assignments, public advisories, or detailed changelogs—a pattern that complicates enterprise vulnerability management and risk assessment.

South Korean Exchange Faces Regulatory Action Following $44.5 Million Hack

South Korea's Financial Supervisory Service (FSS) sent an inspection report to Dunamu, the operator of Upbit cryptocurrency exchange, initiating formal sanction procedures following a 44.5 billion won (approximately $34 million USD) hacking incident. The regulatory action signals potential penalties for security control failures at one of the country's largest digital asset platforms. The move reflects intensifying government scrutiny of cryptocurrency exchange security practices in South Korea, where exchange hacks have resulted in significant customer losses over the past several years.

Sources: Security Affairs · Security Affairs · SBS News