security1 publisher
Red Heron-linked actor turned mid-July wp2shell exploits into 18,566 stolen government records
GreyNoise traced scans from a single IP address, running since early June 2026, to a Chinese-speaking actor that breached 49 organizations through WordPress Core and stripped configs and root hashes from 996 ZyXEL switches.
Publishers:bleepingcomputer.com
Reality
- Evidence45
- Adoption68
- Hype gap+22
- Incentives55
- Confidence52