Emerging Threat Report
Active campaigns, zero-days, and IOCs — Updated weekly. Last update: Aug 18, 2026
Active Campaigns This Week
Mass Exploitation: Unauthenticated RCE via Contact Form Plugin
A botnet of ~14,000 IPs is actively scanning for installations of a widely-used contact form plugin (affects 500k+ sites). The payload uploads a web shell to /wp-content/uploads/ disguised as a .jpg file. Sites with Nexura's WAF are protected via virtual patch signature VS-2026-0881.
Indicators of Compromise (IOC)
- › User-Agent: Mozilla/5.0 (compatible; zgrab/0.x)
- › POST /wp-admin/admin-ajax.php action=cfp_upload
- › Filename: shell.php.jpg
Credential Stuffing Campaign: Targeting WooCommerce Customer Accounts
A large-scale credential stuffing operation is targeting WooCommerce stores using combo lists from the 2025 data breach aggregations. The campaign uses rotating residential proxies to bypass rate limiting. Sites should enforce 2FA immediately for all accounts.
Indicators of Compromise (IOC)
- › High volume of /wp-login.php POST requests
- › IPs in AS range: 45.33.x.x
- › User-Agent rotation pattern detected
PHP Backdoor Obfuscation via Variable Variables
A new PHP backdoor technique uses PHP variable variables ($$var) combined with str_rot13() encoding to evade regex-based malware scanners. The backdoor is typically injected into wp-includes/functions.php. Only AST-based scanners reliably detect this variant.
Indicators of Compromise (IOC)
- › Presence of $${"_"."_"."COOKIE"} in core files
- › Anomalous str_rot13() calls inside class definitions
- › Hidden base64-encoded eval() chains
How Nexura Responds to Emerging Threats
Our threat intelligence feed pushes virtual patch signatures to all Nexura installations automatically. When a new zero-day is discovered, a WAF rule is deployed within hours — before most plugin vendors have even acknowledged the vulnerability.
This "shield first, patch later" approach means your site is protected during the most dangerous window: the days between discovery and the developer's official patch release.
Stay protected against the latest threats with virtual patching and real-time threat intelligence.
Get Free Protection