Blog – PwnDefend

Vulnerabilities found with AI, oh my!

Ok, so the world is currently obsessed with AI (at least the digital world…) and with the latest Apple update releases we can see that LLMs have been used to help people find bugs! This is great news, finding bugs is better than not finding them!

The funny thing however is the obsession with CVE counts…. this is, honestly not a very useful metric to a defending org.. and I’ll try and explain why!

Microsoft 365

Identity Incidents and how to prevent them!

M365 is the most common cloud based business identity platform (be that native or hybrid mode) and so defending this is a key element to business digital security (it’s clearly not the only thing though…. security is a very broad domain!), so I thought I would take a look at incident commonality and controls.

Forensics

Logging Reference — Ollama & Agent Zero

Scope: Where each component writes logs, what it records, what it doesn’t, defaults, and the forensic/detection implications for the lab. Basis: Verified against the running lab (Ollama 0.32.1 on the Windows host + remote 3090; Agent Zero container, Kali-based image). Paths/behaviors confirmed live where noted.

If it’s so powerful, it’s a shame you didn’t…

Imagine building what you describe as the most powerful AI enabled cyber tool…. and then showing the world that you put it in a lab where a single box compromise led to it having unrestricted and unmonitored internet access… that would be awkward would it not? Here’s an LLMs take on this…

Research

Using an LLM for assurance (WP2SHELL)

What better way to test than to eat ones own dogfood right! This site runs WordPress, it is fronted by Cloudflare, has wordfence and has automatic patching enabled (the default) in WordPress. So what better example to show that we can use an LLM + LLM created scripts to conduct assurance activities. This is mixing deterministic and non deterministic technologies to test and then assess.

Strategy

From TimThumb to wp2shell: 25 Years of WordPress Mass…

TL;DR: wp2shell (CVE-2026-63030 chained with CVE-2026-60137) matters because it is a core, pre-authentication RCE reachable on a stock, plugin-free install. That is the rare category. In 25 years, unauthenticated code execution against a bare WordPress install has happened only a handful of times. The overwhelming majority of WordPress mass compromise has ridden the plugin and theme supply chain and infrastructure abuse, not core. This post maps the history so you can see where wp2shell actually sits.

Vulnerabilities

WP2SHELL Update

This morning I’ve started to see exploitation attempts on pwndefend.com (they all failed because like about 80% of sites (based on sampling) this site automatically patched, but also, this site has word fence, is fronted by Cloudflare.

Global Exposure

On the 18th (AM) I did sampling of about 3.5K hosts and found ~20% were not patched. The cyber apocalypse is not seemingly here today! (let alone the fact that if every WordPress site was popped, the world would probably not end)

Threat Intel

WP2SHELL

Yesterday afternoon/early evening a patch for WordPress was released (7.0.2) which address two vulnerabilities which are named: WP2SHELL. This is a fast post (largely generated by Claude Opus) to provide some detail. For reference in our research we have found ~20% of WordPress sites still vulnerable as of a few hours ago (based on a sample), so this is a live scenario and it would be strongly advisable for organisations to take appropriate steps. This morning I’ve built a docker lab of a vulnerable WordPress site and demonstrated hash theft and web shell deployment to a vulnerable lab instance.

I’ve put some resources for people (use at own risk) into a repo: https://github.com/mr-r3b00t/wp2shell/

that includes a scanner, some info on the vulns and a PoC tool!

Leadership

You Cannot Block Infinity

We should block the RMM! We should block that IP! We should block that port! The trouble is; there’s 65535 ports per protocol (TCP/UDP), there’s billions of IPs (dynamic and rotating infra are a thing), and well that’s a lot of work, neve ending, in fact!!

This topic has come up a number of times recently so I thought I’d put it into a blog, so I had Claude generate this based on my quick fire views:

Cybercrime

When the negotiators go bad!

Every ransomware incident runs on one uncomfortable assumption: that the people you bring in to help are actually on your side. A case that concluded in a Florida federal court this month blew a hole straight through that assumption. Three cyber professionals — two of them ransomware negotiators whose day job was to defend victims — have been sentenced for working as an affiliate crew of the ALPHV/BlackCat operation. One of them didn’t just moonlight as an attacker; he sold out the very clients who were paying him to protect them.

This is not another “big scary ransomware gang” story. It’s an insider-threat story, and it lands right in the middle of the incident-response industry itself. If you run an IR practice, negotiate on behalf of victims, broker cyber insurance, or you’re a CISO who will one day have to trust one of these firms on the worst day of your career — this one is worth your time.