Cyber Threat Brief — July 21 2026

1. ServiceNow AI Platform Pre-Auth Sandbox Escape — CVE-2026-6875

TL;DR: Unauthenticated RCE in ServiceNow via GlideRecord sandbox escape at /assessment_thanks.do. ITW exploitation confirmed July 18-20 with multiple bypass chains — patch immediately.

What’s New:

• Searchlight Cyber disclosed July 13; ServiceNow patched hosted instances next day, self-hosted patches available since June
• Pre-auth sink at /assessment_thanks.do via sysparm_assessable_type parameter passes unsanitized input to GlideRecord.addQuery() which accepts javascript: prefix for expression evaluation
• Second sandbox-escape gadget chain confirmed July 20 that bypasses defenses tuned to original PoC — same code-execution primitive via different escape route
• Full instance compromise: table data access, admin account creation, command execution on connected MID Server proxies
• Fixed in Brazil EA/GA, Australia Patch 2, Zurich Patch 7b/9, Yokohama Patch 12 HF1b/13

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
GET/POST /assessment_thanks.do with sysparm_assessable_type	Exploitation endpoint	T1190	ServiceNow sys_audit / web logs	WAF block or monitor anomalous requests
javascript: prefix in GlideRecord query params	Sandbox escape payload	T1059.007	ServiceNow script logs	Alert on javascript: in query parameters
Unauthorized admin account creation	Post-exploitation	T1136.001	ServiceNow sys_user table audit	Monitor for unexpected admin user inserts
MID Server unexpected process creation	Lateral movement	T1569.002	MID Server OS logs	Hunt for anomalous child processes from MID Server agent

Detection

Source	Rule	Gap
Splunk ESCU	None	No rule for ServiceNow assessment_thanks.do abuse or GlideRecord sandbox escape
Elastic	None	No coverage for ServiceNow-specific exploitation
Sigma	None	No rule for ServiceNow sandbox escape patterns

Sources: Help Net Security, BleepingComputer, SecurityOnline

2. wp2shell WordPress Core RCE — CVE-2026-63030 + CVE-2026-60137 [UPDATE: ITW Exploitation Confirmed]

TL;DR: WordPress Core pre-auth RCE chain now confirmed exploited at scale. Mass scanning from 13+ IPs across 7 countries. Webshells being deployed in /wp-content/cache/. Update to 6.9.5/7.0.2 NOW.

What’s New:

• Status change: active → active-itw as of July 18-20
• ITW exploitation confirmed by Wiz, VulnCheck, SecurityWeek, and KEVIntel telemetry
• 13 unique attacker IPs from CH, DE, GB, ID, LT, NL, SG identified by KEVIntel
• Attack chain: automated batch endpoint scanning → credential hash exfiltration → admin brute force → PHP webshell deployment
• Tool signatures in User-Agent: wp2shell and rezwp2shell identify purpose-built exploitation frameworks
• WP-SHELLSTORM crew attributed to opportunistic mass exploitation
• Webshell artifacts: suspicious PHP files (e.g., 94uh9ubh6e1x.php) in /wp-content/cache/
• HTTP 207/200 Multi-Status responses to /wp-json/batch/v1 indicate successful exploitation (per Hexastrike)

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
POST /wp-json/batch/v1 or ?rest_route=/batch/v1	Exploitation endpoint	T1190	Web access logs	WAF block anonymous batch API access
author__not_in with SQL payload	SQLi parameter	T1190	Web access logs / WAF	Inspect for anomalous author__not_in values
UA: wp2shell, rezwp2shell	Tool signature	T1190	Web access logs	Block/alert on these User-Agent strings
PHP files in /wp-content/cache/	Webshell drop	T1505.003	File integrity / Sysmon	Monitor for new .php in cache dirs
Unauthorized admin users	Post-exploitation	T1136.001	WordPress wp_users table	Audit for unknown admin accounts

Detection

Source	Rule	Gap
Splunk ESCU	Web Shell Indicator (generic)	No wp2shell-specific rule for batch endpoint abuse or author__not_in SQLi
Elastic	None	No WordPress batch API exploitation rule
Sigma	None	No rule for WordPress REST batch endpoint abuse

Sources: The Hacker News, SecurityWeek, Wiz, VulnCheck

---

Status Updates

• CVE-2026-58644 (SharePoint RCE): Federal CISA KEV deadline passed July 19. Pre-auth deserialization RCE. Active exploitation ongoing. Original brief.
• CVE-2026-39808/25089 (FortiSandbox): Federal CISA KEV deadline passed July 19. Triple-CVE chain active exploitation ongoing. Original brief.
• CVE-2026-15409/15410 (SonicWall SMA1000): Federal deadline passed July 17. UTA0533 zero-day exploitation ongoing since June 22. Original brief.