WordPress Is on Fire, AI Finds 570 Windows Bugs, and Your GPU Could Crash the Grid
Tuesday, July 21, 2026 · 5-minute read
Hackers are actively exploiting two critical WordPress flaws nicknamed wp2shell. Combine them and an attacker who has never logged in to your site can run any code they want on your server. Researchers at watchTowr say exploitation started Saturday morning and has already hit organizations of every size across every industry — with scanning traffic originating from IP addresses in Switzerland, Germany, the UK, Indonesia, Lithuania, the Netherlands, and Singapore.
↗ The Hacker NewsMicrosoft's July Patch Tuesday fixed 570 security holes — nearly triple last month's already record-breaking count. The company says AI-assisted vulnerability discovery is why the numbers keep climbing. Nearly 60 of the bugs are rated Critical, meaning attackers could take over a Windows PC with little or no help from the user. Three of the fixes cover zero-day flaws, and two of those are already being actively exploited in the wild.
↗ Krebs on SecurityA contractor accidentally published 844 MB of sensitive CISA data — including admin keys to three government Amazon cloud servers and plaintext passwords for dozens of internal systems — to a public GitHub repository. It sat there for nearly six months. CISA received nine automated alerts from security firm GitGuardian before a reporter's nudge finally triggered action. The agency has now published a postmortem admitting it needs clearer reporting channels and faster key rotation.
↗ Krebs on SecurityThe Qilin ransomware gang is exploiting a critical flaw in Palo Alto's PAN-OS GlobalProtect VPN software to break directly into company networks — no phishing email required. Once inside, the group deploys ransomware to lock up files and demand payment. Arctic Wolf researchers confirmed the active exploitation. If your organization uses Palo Alto GlobalProtect and hasn't patched recently, you're a potential target right now.
A criminal operation called JADEPUFFER — which runs an autonomous AI agent to carry out attacks — has deployed brand-new ransomware called ENCFORGE. Unlike typical ransomware that goes after documents and spreadsheets, ENCFORGE specifically targets AI infrastructure: the trained model files, datasets, and databases that companies spend months and millions building. The entry point is a known, unpatched flaw in Langflow, an AI development tool. The flaw has had a patch available since early 2025 — many servers simply never applied it.
Two flaws in WordPress core that, when used together, let a complete stranger run any code they want on your web server — no login, no account, no inside access needed. Think of it as a skeleton key that also sets your house on fire. Public exploit code is already circulating, and mass scanning began over the weekend. Researchers say successful attacks are happening right now across organizations of every size.
Status: Patch available — update WordPress immediately. If you use managed WordPress hosting, check that your host has applied the update on your behalf and confirm with them directly.
Langflow is a popular tool developers use to build AI applications. Versions before 1.3.0 have an unauthenticated API endpoint that lets anyone on the internet run arbitrary Python code on the server — essentially handing over the keys to the machine. This flaw has been actively exploited since at least May 2025 and is now being used to deploy the new ENCFORGE ransomware targeting AI assets.
Status: Patch available since early 2025 — update to Langflow 1.3.0 or later. This flaw has been on CISA's Known Exploited Vulnerabilities list since May 5, 2025. If you haven't patched yet, assume you may already be compromised and investigate.
A newly disclosed zero-day flaw in Windows lets an attacker who already has basic access to your PC quietly upgrade themselves to full administrator privileges — on a fully up-to-date system. Microsoft hasn't issued an official patch yet, but the security community has released free unofficial fixes in the meantime. This is the kind of flaw often used as a second step after an initial infection to gain deeper control.
Status: No official Microsoft patch yet. Free unofficial patches are available from the security community. Consider applying the workaround, especially on sensitive systems, while waiting for Microsoft's official fix.
When a software company ships a security fix, it accidentally publishes a roadmap to the bug it just fixed — anyone who compares the old code to the new code can figure out exactly what was broken. Turning that knowledge into a working attack used to take expert hackers weeks of painstaking work. Mythos, a tool developed and measured by Anthropic's red team, can do it in roughly an hour. This is not a tool being sold or released publicly — it's a research demonstration of just how fast N-day exploitation is becoming. The implication is stark: the window between a patch being released and attackers having a working exploit is now measured in hours, not weeks. The old advice of "patch within 30 days" is increasingly dangerous — organizations that delay even a few days after a patch drops are now at serious risk.
Security researchers discovered a new malware component called HollowGraph that uses a genuinely clever hiding trick: once it infects a Microsoft 365 account, it uses the calendar feature as a secret command-and-control channel. Attackers send instructions disguised as calendar events, and the malware reports stolen data back the same way — all through Microsoft's own legitimate infrastructure. Because the traffic looks like normal Microsoft 365 activity, many security tools won't flag it. This technique makes the malware much harder to detect and block than traditional methods.
A group of researchers just published a paper with a genuinely unsettling idea: a paying customer of a cloud computing service — someone doing nothing illegal, using resources they've legitimately rented — could potentially cause disruptions to the electrical grid the data center runs on. No hacking. No malware. No stolen passwords. Just a very specifically designed workload.
Here's how it works. Modern GPUs — the powerful chips that run AI and other heavy computing tasks — draw a lot of electrical power when working hard and very little when idle. Researchers from Zhejiang University, in a paper accepted to a top hardware security conference, showed that you can deliberately write a program that rapidly flips a GPU between full power and idle on a precise schedule. This creates a controlled oscillation in power demand at the wall socket. Now imagine thousands of GPUs in a data center doing that in sync. The power swings could be large enough and fast enough to interfere with the stability of the local electrical grid — the same grid that powers hospitals, traffic systems, and homes nearby. The researchers call this Bit2Watt.
What makes this genuinely novel is that it inverts every assumption about how you attack power infrastructure. Traditional attacks on power grids require compromising industrial control systems, planting malware on specialized equipment, or stealing operator credentials — all of which require significant skill and access. Bit2Watt requires none of that. It requires a cloud account and a creatively written program. The researchers were careful to note they measured the power effects on real GPUs but only simulated the grid impact — they didn't actually try to destabilize a grid. But the physics are real.
For regular people, there's no direct action to take here — this is a problem for cloud providers, grid operators, and regulators to work out. But it's worth understanding because it illustrates a pattern that's becoming more common in security research: as our digital and physical infrastructure become more intertwined, the boundary between a "software problem" and a "real world problem" keeps dissolving. Watch for cloud providers to start implementing power-draw rate limiting and for grid operators to begin requiring new resilience standards from data centers as this research gets wider attention.