Cybersecurity Intelligence Report  2026-07-19

CRITICAL

• [11] Two new high severity WordPress vulnerabilities, patch immediately! (HelpNetSecurity)
  CVEs: CVE-2026-60137,CVE-2026-63030
  <p>The 7.0.2 WordPress security release addresses one critical and one high severity security issue. The vulnerabilities reported to the WordPress security team include: CVE-2026-60137 &#8211; A facilitated SQL injection issue reported as a team by TF1T, dtro, and haongo CVE-2026-63030 &#8211; A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution reported by Adam Kues at Assetnote / Searchlight Cyber Which versions of WordPress are vulnerable? WordPress 6.9 is

CISA KEV (last 14 days)

No CISA KEV items in the last 14 days.

RANSOMWARE VICTIMS (today)

dragonforce: NewNet

krybit: euroins.bg

nova: FMZ Tecnologia em Sistemas

qilin: Heartland Catfish, Salina Supply, St Martha Catholic Church, The Nueva School, Sicc, KLD Labs, Armara, AK Preparedness

threeam: tws-tac.net

NEWS

• [9] WordPress Core "wp2shell" RCE flaws get public exploits, patch now (BleepingComputer)
  Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately. [...]
• [7] Update now: 7-Zip fixes RCE flaw exploitable with malicious archives (BleepingComputer)
  7-Zip version 26.02 was released to fix a remote code execution vulnerability that could allow attackers to execute malicious code by convincing users to open specially crafted compressed files. [...]
• [7] [RANSOMWARE] dragonforce leaked NewNet (ransomware.live/dragonforce)
  Victim: NewNet | Group: dragonforce | Website: newnetsa.com | Country: SA | Details: NewNet S.A. is a Colombian company specializing in managing IT risks, offering advanced and personalized data protection services. Their extensive range of services includes information security, cybersecurity, business continuity, and governance, risk, and compliance (GRC) solutions. They cater to
• [5] [RANSOMWARE] krybit leaked euroins.bg (ransomware.live/krybit)
  Victim: euroins.bg | Group: krybit | Website: euroins.bg | Country: BG | Details: Euroins Insurance Company AD (Застрахователна компания Евроинс АД) is one of the first a...
• [5] [RANSOMWARE] nova leaked FMZ Tecnologia em Sistemas (ransomware.live/nova)
  Victim: FMZ Tecnologia em Sistemas | Group: nova | Country: BR | Details: FMZ Tecnologia em Sistemas is a Brazilian software company that develops solutions for the book industry. Its main product, HORUS, is an ERP system designed for publishers, bookstores, and distributors. The system helps manage inventory, sales, royalties, and consignment operations. The company has
• [5] [RANSOMWARE] qilin leaked Heartland Catfish (ransomware.live/qilin)
  Victim: Heartland Catfish | Group: qilin | Website: www.heartlandcatfish.com | Country: US | Details: N/A
• [5] [RANSOMWARE] qilin leaked Salina Supply (ransomware.live/qilin)
  Victim: Salina Supply | Group: qilin | Website: www.salinasupply.com | Country: US | Details: N/A
• [5] [RANSOMWARE] qilin leaked St Martha Catholic Church (ransomware.live/qilin)
  Victim: St Martha Catholic Church | Group: qilin | Website: www.stmartha.com | Country: US | Details: N/A
• [5] [RANSOMWARE] qilin leaked The Nueva School (ransomware.live/qilin)
  Victim: The Nueva School | Group: qilin | Website: www.nuevaschool.org | Country: US | Details: N/A
• [5] [RANSOMWARE] qilin leaked Sicc (ransomware.live/qilin)
  Victim: Sicc | Group: qilin | Website: www.sicc-srl.com | Country: IT | Details: N/A
• [5] [RANSOMWARE] qilin leaked KLD Labs (ransomware.live/qilin)
  Victim: KLD Labs | Group: qilin | Website: www.kldlabs.com | Country: US | Details: N/A
• [5] [RANSOMWARE] qilin leaked Armara (ransomware.live/qilin)
  Victim: Armara | Group: qilin | Website: www.armara.fr | Country: FR | Details: N/A
• [5] [RANSOMWARE] qilin leaked AK Preparedness (ransomware.live/qilin)
  Victim: AK Preparedness | Group: qilin | Website: www.akpreparedness.com | Details: N/A
• [5] [RANSOMWARE] threeam leaked tws-tac.net (ransomware.live/threeam)
  Victim: tws-tac.net | Group: threeam | Website: tws-tac.net | Country: DE | Details: While ownership has changed over the years, the company has remained locally owned for over 65 years and family-owned for almost 40 years. The company is proud of the company's history and look forward to the future as the company continue to serv

SUMMARY

Total new items: 17. Critical: 1. Ransomware groups active: 12.

Top CVEs to patch urgently: CVE-2026-60137, CVE-2026-63030

Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live