Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-linked actor exploited WordPress and Zyxel flaws, stealing government records from dozens of organizations.
GreyNoise says a Chinese-speaking actor linked to Red Heron exploited WordPress core wp2shell flaws CVE-2026-63030 and CVE-2026-60137, breaching at least 49 organizations in 29 countries. One Western government intrusion produced at least 18,566 SQL records with accounts, plaintext passwords, and law-enforcement PII after AMSI bypass, token theft, local-admin creation, and password spraying. On August 17 the actor used CVE-2026-7273 to compromise 996 Zyxel GS1900 switches in 48 countries and also targeted UniFi OS, PAN-OS GlobalProtect, FlowiseAI, Gitea, Nuclio, Proxmox VE, SENAITE LIMS, and Dirty Pipe. CISA has the three UniFi bugs on the KEV list; GreyNoise published backdoor and C2 indicators.
- wp2shell flaws CVE-2026-63030 and CVE-2026-60137 hit at least 49 organizations.
- Intrusion stole 18,566 records with accounts, plaintext passwords, and PII.
- CVE-2026-7273 compromised 996 Zyxel GS1900 switches across 48 countries.
- Cluster also targeted UniFi, GlobalProtect, FlowiseAI, Gitea, Proxmox, and Dirty Pipe.
- GreyNoise ties the activity to a Red Heron-related actor and published IoCs.
- CVEs
- CVE-2026-63030CVE-2026-60137CVE-2026-7273CVE-2026-34908CVE-2026-34909CVE-2026-34910CVE-2026-56271CVE-2022-0847CVE-2026-60004CVE-2026-79756CVE-2026-54569CVE-2023-54391
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1110.003 Password SprayingT1562.001 Disable or Modify ToolsT1134.001 Token Impersonation/TheftT1136.001 Create Account: Local Account
- Threat actors
- Red Heron
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-0847 | Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel | 7.8 | 93% | KEVPoC ×4 | KEV |
| CVE-2023-54391 | Authentication bypass in Proxmox VE login API (libpve-access-control) | 9.3 | 2% | ||
CVE-2026-34910+2 related CVEs | Unauthenticated Command Injection in Ubiquiti UniFi OS Devices | 10.0 | 90% | KEVPoC | KEV |
| CVE-2026-54569 | SENAITE.CORE: The SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing… | 9.8 | <1% | ||
| CVE-2026-56271 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and… | 9.3 | <1% | ||
| CVE-2026-60004 | Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection | 9.8 | 24% | KEVPoC ×5 | KEV |
CVE-2026-63030+1 related CVE | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE | 9.8 group max | 11% | KEVPoC ×9 | KEV |
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8 | 3% | KEVPoC | KEV |
| CVE-2026-79756 | Unauthenticated OS Command Injection in Nuclio Dashboard (Local/Docker Platform) | 8.7 | 5% |
From the original article
2 min read at bleepingcomputer.com
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.