A busy week for hackers, and a bad one for IT teams
Security researchers are tracking three separate attack campaigns this week, each targeting software used by millions of businesses and website owners. The targets include WordPress, the platform that powers a huge share of the world's websites, Microsoft SharePoint, used for internal file sharing and collaboration at companies large and small, and Palo Alto Networks VPN products, which many businesses rely on to let employees connect to their networks remotely. In each case, attackers found a way in before most organizations had a chance to patch.
WordPress sites hit by the "wp2shell" bug pair
The first campaign involves two flaws in WordPress itself, nicknamed wp2shell by researchers because of what happens once they are chained together. On their own, each bug is limited. Combined, they let an attacker take over a WordPress site without ever needing a username or password.
Once inside, attackers are planting what security professionals call a webshell, which is basically a hidden control panel that lets them run commands on the server whenever they want. From there, they can install malicious plugins, steal data, redirect visitors to scam pages, or use the site as a launching pad for further attacks. Because working exploit code for this bug pair became public over the weekend, scanning and attack attempts spread fast, hitting sites within hours of the news breaking.
SharePoint attackers are stealing keys, not just files
The second campaign targets a flaw in Microsoft SharePoint. Attackers are using it to run their own code on vulnerable servers, but the more troubling part is what they do next: they steal something called a machine key. This key is used behind the scenes to keep a server's internal systems working correctly and trusting each other.
Normally, patching a vulnerability closes the door an attacker used to get in. But if attackers already grabbed the machine key before the patch went out, they may still be able to get back into the system afterward, because the stolen key still works. This means organizations that were compromised even briefly need to do more than just install a security update. They need to rotate those keys and check for signs that someone was already inside.
Qilin ransomware group breaks into networks through VPN software
The third attack involves a well known ransomware crew called Qilin, which has found a way to slip past the login screen on certain Palo Alto Networks VPN devices. This type of flaw, called an authentication bypass, lets an attacker act as if they already logged in successfully, skipping the password check entirely.
VPN devices sit at the edge of a company's network, which makes them a prime target. Once Qilin gets through, the group can move deeper into the network, lock up files with ransomware, and demand payment. Security researchers say this bug is already being used in real attacks, not just tested in a lab, which raises the pressure on any business still running an unpatched version of the affected software.
Why these three stories matter together
None of these attacks is aimed at everyday home users directly, but the sites and services people rely on every day run on exactly this kind of software. A hacked WordPress blog can quietly infect its visitors. A breached company network can lead to leaked customer data, including names, emails, and passwords tied to your own accounts. A ransomware attack that starts with a VPN login can shut down a hospital, a school district, or a store you shop at regularly.
The pattern across all three incidents is the same: attackers moved fast once details of the flaws became known, often within a day or two. That short window is exactly why patching quickly matters so much, and why organizations that wait even a week can end up compromised before they get the chance to fix anything.
What you should do
- If you run a WordPress site, update WordPress core immediately and check your plugin list for anything you did not install yourself.
- If your organization uses SharePoint, install the latest security update and ask your IT team to confirm whether machine keys have been rotated, not just patched.
- If your company uses Palo Alto Networks VPN products, confirm with IT staff that the software is fully updated and that login logs are being reviewed for unusual activity.
- As an individual, keep an eye out for breach notification emails from companies you use, and turn on two factor authentication wherever it is offered so a stolen password alone cannot get an attacker into your account.
- Avoid reusing passwords across sites, since a breach at one company can otherwise open the door to your accounts elsewhere.
