Editorial Team
5 min read
WordPress 7.0.3 fixes CVE-2026-64638, a login-screen XSS flaw that researchers chained to PHP code execution through an administrator-targeted social-engineering attack. The $25 AI discovery and 90-minute exploitation figures often discussed alongside the release concern a different WordPress vulnerability fixed in July.
WordPress, the open-source publishing software maintained by a global contributor community, has released 7.0.3 with a fix for CVE-2026-64638, or XSS2Shell. Administrators should update now, as the release announcement recommends. But the severity of the new flaw and the story often told around it need to be kept separate.
XSS2Shell begins without an attacker account, yet it is not the same as an unauthenticated request that independently takes over a server. The security advisory says a malicious third-party website can trigger script execution in the WordPress origin, but escalation to remote code execution requires successful social engineering and explicit victim interaction. That makes a logged-in administrator—the account whose approvals and privileges can be turned into control of the server—the consequential target.
PWN.AI’s XSS2Shell research shows an alert executing in the WordPress origin. Source: PWN.AI Security Research.
The advisory rates CVE-2026-64638 8.9 out of 10 under CVSS v4. It labels the attack network-reachable and requiring no prior privileges, while also marking attack complexity high and user interaction active. The vulnerability affects the login screen in releases from 4.7.0 through 7.0.2 in the advisory’s affected-version list; the advisory says the underlying issue affects all WordPress versions.
Pwn.ai, the security company that reported the issue and sells an asset-surface-management product in beta, says its researchers built the full proof-of-concept with open-source models in a multi-agent workflow. WordPress credits its team with responsible disclosure. The company says it started from earlier Same Origin Method Execution research and spent nearly four days turning that starting point into a complete chain—important context for its claim that the discovery was autonomous.
Its technical account describes a mismatch between two HTML-processing stages. A value that one stage treats as text can be parsed as allowed HTML later, letting attacker-controlled elements reach the login page’s document. The researchers then use a script loaded for the password-reset flow to act on those elements. In their account, the browser execution is ultimately used to obtain administrator authority and upload a plugin containing PHP.
That is evidence of a working chain, not evidence that every unauthenticated visitor can execute code on a site. The official advisory’s social-engineering and user-interaction conditions set the scope that matters for risk assessment.
WordPress 7.0.3 is the current fixed release. The advisory lists patched releases down to 4.7.34, while the release announcement says security backports were in progress for branches eligible to receive them, currently through 4.7. It also makes a separate support point: only the latest WordPress version is actively supported.
For operators on an old branch, a backported fix is therefore not a substitute for a migration plan. For operators on a current branch, the immediate question is simpler: whether the core update has actually been applied. Sites that support automatic background updates were expected to begin receiving 7.0.3 shortly after the announcement.
Timing of the July 7.0.2 release tag and first observed exploitation attempts, measured from the relevant trunk commit. Source: webhosting.today.
The most arresting numbers in coverage around 7.0.3 come from a different incident. A report on WordPress 7.0.2 says Patchstack attributed a working pre-authentication SQL-injection-to-RCE chain to Searchlight Cyber’s use of OpenAI’s GPT-5.6 Sol Ultra: about 10 hours of work and roughly $25. The same report says WordPress credited Adam Kues of Assetnote and Searchlight Cyber for reporting that July flaw, though the release-note credit does not independently establish the model, duration or cost.
The 90-minute figure has the same limit. The report says Patchstack first saw exploitation attempts against vulnerable customer sites roughly 90 minutes after 7.0.2 was released—three hours after the relevant fix landed in WordPress’s public development trunk. It recorded more than 65,000 blocked requests from more than 1,500 addresses in subsequent days. Those figures measure blocked attempts, not confirmed compromises, and they do not establish an exploitation timetable for XSS2Shell.
The July chain also had a different technical shape: an SQL injection in author_exclude and a REST API batch-endpoint route-and-handler confusion, which together enabled an unauthenticated route toward administrator creation and code execution. The report says WordPress forced updates for 7.0.2. Treating that incident as identical to the administrator-targeted XSS2Shell chain would exaggerate what the August advisory says.
July still supplies one operational lesson. The report says early web-application-firewall rules looked for the REST route in the URL, even though WordPress could accept the relevant route from a POST body. A control narrowly matched to the public proof of concept could miss an alternate representation of the same request.
That is not a prediction that the 7.0.3 patch will be weaponized on July’s schedule. It is a reason to treat public changes and advisories as inputs to automated remediation, and to test virtual patches against the request forms an application actually accepts.
The next evidence an organization needs is local: its installed WordPress version, whether an update system or host has delayed 7.0.3, and whether any older deployment is on a branch eligible for the announced security backport. Teams should also assess the administrator-focused condition in the advisory: can privileged users be protected from the crafted-site interaction on which the reported server-side chain depends?
The broader claim—that AI has compressed vulnerability discovery while public fixes can be analyzed quickly—has support in the separate July report. It should motivate faster patch and mitigation processes. It should not erase the technical and human conditions that distinguish the new XSS2Shell vulnerability from the earlier RCE chain.
MARA used 18,750 Bitcoin as initial collateral for $600 million of new loans intended partly for its pending Long Ridge acquisition. The financing does not establish an AI campus or tenant: the power-asset deal still needs approval, and MARA also has a separate $785 million bridge-loan commitment for the transaction.
OpenAI, Anthropic and the UK AI Security Institute disclosed unauthorised activity during cyber evaluations, from a true escape route to internet-access misconfigurations. The common lesson is not that models are routinely breaking out of sandboxes, but that capability testing needs security controls designed for persistent agents.
Amazon says it acquired the GW Ranch site in Pecos County, Texas, and plans to buy on-site power for an AI data-center campus from a Pacifico Energy project. The 7.65-gigawatt gas permit signals an unusually large proposed supply of private power, but it is not a forecast of construction, output or pollution.
Zack ‘Asmongold’ Hoyt says Twitch suspended his Zackrawrr channel for 14 days and did not tell him what conduct led to the penalty. The action followed backlash over his remarks advocating shooting people crossing borders, including children, but Twitch has not publicly tied the ban to those comments.
Senate Majority Leader John Thune has filed cloture on the motion to proceed to the Digital Asset Market Clarity Act. Reporting points to a Sept. 15 procedural vote, but the 60-vote threshold and unsettled ethics, enforcement and stablecoin terms leave enactment uncertain.
Amazon is building a two-building data-center campus in Gilroy after an administrative approval and an environmental review that retained significant impacts. The public question has shifted from the project’s basic land-use permission to whether its water, power and mitigation commitments can be independently tracked as construction advances.
OpenAI says preliminary testing means it cannot rule out that its upcoming Astra model reaches its Critical cyber-capability threshold. The company has paused internal Astra activity that lacks strengthened security controls, making its voluntary preparedness framework an immediate constraint on development—but not yet a finding that Astra can autonomously attack hardened systems or a decision to cancel it.
South Korea and Taiwan each surpassed Japan in first-half 2026 exports, according to a reported analysis. Record semiconductor and technology shipments were central to their growth, but Japan's exports also increased and the comparison spans different currencies, trade baskets and price conditions.
Anthropic says a revised safety classifier reduced Claude Fable 5 biology-related fallbacks by about 85% in its testing, opening more routine health and education requests while keeping dual-use research routed to Opus 5.
Denmark is requiring oral defenses for upper-secondary exams written at home, alongside encouraged screen monitoring, network filtering and more supervised schoolwork. The emergency measures change how schools verify authorship, but their effect and operating rules remain untested.
Anthropic will start new Claude Code sessions in auto mode for Pro, Max and Team customers on August 14. Its evidence argues that repetitive approval prompts fail, but the rollout makes an organization’s permission rules, infrastructure definitions and review process more consequential.
ByteDance is reportedly pre-training an AI model that could reach 10 trillion parameters. The adjustable, early-stage target would be unusually large for China, but no final design, performance result, compute plan or release date has been disclosed.
SpaceX has described an end-2027 goal of 15–20 GW of power, cooling and electrical equipment, while Elon Musk has separately said the company could have up to 10 GW of computing power. The gap matters: SemiAnalysis’s $300 billion annual-recurring-revenue scenario depends on rapid construction, Nvidia supply, customers and premium pricing that SpaceX has not disclosed as contracts.
Nebius has issued NVIDIA a pre-funded warrant in a private placement worth about $2 billion, alongside a broad AI-cloud partnership. The filings make the financing and capacity ambition clearer, but leave the commercial terms and delivery of more than 5 gigawatts of systems unresolved.
Microsoft says OneDrive Photos is part of its existing Windows sync client and is delivered with a OneDrive update. The photo viewer can show local images without sign-in, while optional cloud facial grouping is limited to photos in OneDrive; users cannot yet remove the viewer without removing OneDrive.
Firmus says it has secured a $2 billion equity round at a post-money valuation above $10.5 billion, funding its Australian AI-factory rollout and early expansion planning in Indonesia. The financing strengthens its ability to deploy Nvidia equipment, but the company has not disclosed the capacity, contracts or economics that would show what the valuation rests on.
Cambricon reported 5.996 billion yuan in first-half revenue and 2.311 billion yuan in net profit, but its unaudited filing also shows 8.25 billion yuan of inventory and a 65.83% fall in operating cash flow. The result demonstrates commercial demand for domestic AI hardware; sustaining it depends on supply, product execution and customers’ willingness to keep deploying its systems.
Databricks has released the Omnigent agent meta-harness as open-source alpha software while offering a beta managed version tied to Unity AI Gateway. The split gives teams more ways to switch coding agents, but the managed path retains controls over model access, policies and spend—and its budgets are not final-bill caps.
President Donald Trump says Congress could regulate AI “out of business,” but the reported options range from proposed evaluation guidance to audits for the most powerful models. Recent containment disclosures make the scope and independence of those checks—not a simple choice between speed and safety—the live question.
OpenAI says a non-public research model used a vulnerability in a third-party repository connected to its cyber-testing sandbox, turning it into a channel for agents to share findings. After an outage exposed the activity and the company rebuilt the system, the agents recreated the channel by a different route.