Today’s digest is about attackers reaching for the workflow you already trust — a login page every visitor sees, an authentication flow built for convenience, a bank email that looks routine. Here’s what changed since yesterday’s digest.
Vulnerability watch: WordPress ships an emergency fix for a pre-auth XSS that chains to full PHP code execution
WordPress released version 7.0.3 on August 6, an emergency patch for CVE-2026-64638 (CVSS 8.9), nicknamed XSS2Shell, alongside eleven other security fixes. The bug lives in how WordPress handles failed-login input: a crafted username survives WordPress’s own sanitization as harmless text, but a later HTML-handling step on the login error page renders it as active markup, so the resulting JavaScript runs in any visitor’s browser with no authentication and no further interaction. Researchers reproduced the flaw on July 26, reported it the next day, and WordPress shipped the fix on August 6 — backported to every maintained branch back to WordPress 4.7, meaning it affects essentially every WordPress site in active use. The XSS alone is bad enough on a public login page; chained further, the same flaw can escalate to arbitrary PHP execution if an already-logged-in Administrator clicks an attacker-controlled link — a single ordinary click, per the researchers’ proof of concept. The Hacker News · SOCRadar
Because this hits the login page — reachable by definition, unauthenticated by definition — every WordPress install you or your customers run needs 7.0.3 now, not on the next content-team release cycle. If you manage WordPress at scale, treat this the way you’d treat a browser zero-day: patch first, then check for anomalous admin-session activity in the days since July 26 in case someone got there first.
Threat intel watch: CrowdStrike’s 2026 Threat Hunting Report finds device-code phishing up 15-fold this year
CrowdStrike published its 2026 Threat Hunting Report at Black Hat USA this week, and the standout figure is a 15-fold increase in device-code phishing attempts in the first half of 2026 compared to the second half of 2025. The technique abuses the legitimate OAuth device-authorization flow — the same “enter this code on another device” prompt used for smart TVs and CLI tools — tricking a victim into approving a real login session for an attacker who never touches the victim’s password. Russia’s Cozy Bear (APT29) is a prominent user of the technique against cloud identities, alongside financially motivated crews delivering device-code phishing pages via Entra ID OAuth redirects hosted on legitimate cloud services. The same report found vishing intrusions roughly doubled year-over-year, cloud-conscious eCrime activity up 171%, and — worth flagging on its own — 88% of observed exploitation against vulnerabilities with public PoC code happened within 48 hours of release. CrowdStrike · Dark Reading
Device-code phishing bypasses the credential and MFA prompts your detection rules are probably tuned for, since the victim completes a real login themselves. If you haven’t already, restrict device-code flow to managed devices via Conditional Access, alert on device-code sign-ins from unfamiliar client IDs, and treat that 48-hour PoC-to-exploitation window as your real patch SLA, not a talking point.
Threat intel watch: a Bank of America phishing campaign installs remote-access malware that fights back against removal
Researchers at Huntress identified an active phishing campaign impersonating Bank of America, sent from a lookalike address, warning recipients they must act “to avoid account restrictions.” Windows users who click land on a BoA lookalike page pushing a download called “Account Guard” — a Visual Basic script that silently installs the legitimate ConnectWise ScreenConnect remote-monitoring tool, giving the attacker persistent, hard-to-detect access to the machine. Mac users are routed instead to a credential-and-payment-details harvesting page. The ScreenConnect install is deliberately hardened against cleanup: SDDL access-control lists block the logged-in user from modifying the process, and the client conceals itself from casual inspection, so a victim who suspects something’s wrong can’t simply remove it. Help Net Security · Huntress
ScreenConnect is a legitimate, widely deployed RMM tool, which is exactly why it’s a popular payload — it doesn’t trip the alarms a custom RAT would. If your EDR allow-lists ScreenConnect or other RMM software for IT use, alert on new installer events for those tools outside your known deployment process, and add this specific lure (“Account Guard,” restricted-account BoA emails) to phishing-awareness material this week.
Also noted: an unpatched Fastjson 1.x flaw is under active attack with no fix coming
Security firms ThreatBook and Imperva report ongoing exploitation of CVE-2026-16723 (CVSS 9.0) in Fastjson, Alibaba’s widely used Java JSON library, affecting versions 1.2.68 through 1.2.83. The flaw needs no AutoType enablement and no classpath gadget, letting an unauthenticated attacker run arbitrary code on Spring Boot applications packaged as fat-JARs — verified across Spring Boot 2.x, 3.x, and 4.x on JDK 8 through 21. Financial services, healthcare, computing, and retail organizations are the primary targets, with the US seeing the most attack traffic. Because Fastjson 1.x is no longer maintained, no patched 1.x release exists or is coming — the only fix is migrating to Fastjson 2.x after compatibility testing. SecurityWeek
If Fastjson 1.x is buried inside a fat-JAR somewhere in your Java stack, this is a “find it before you fix it” problem — audit dependency trees for the affected version range now, since there’s no patch to wait for and migration will take longer than most active-exploitation windows.
Final thought
Three of today’s four stories work because they ride a legitimate mechanism — a login page, an OAuth device flow, an IT admin tool — rather than forcing their way in. Signature-based detection struggles with all three; behavioral monitoring on the surrounding activity (unexpected admin-session actions, device-code logins from unfamiliar clients, new RMM installers) is what actually catches them. If you want help figuring out where your detection coverage assumes “legitimate mechanism” means “legitimate use,” see our how-to guides or book a discovery call.