Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

Hacktron AI

4,692 subscribers

39,685 views • 2 months ago •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

4 Comments

YogSotho2 months ago

@assetnote *uninstall your wordpress

ddddddddddd2 months ago

@assetnote nice to see sql injection still going strong in 2026

Lilith Datura2 months ago

@assetnote SQL

Sakir2 months ago

@assetnote where php script ?

Related Videos

One missing array entry started it all. then two WordPress core bugs chained through SQL injection, cache poisoning and an administrator identity switch -> ending in unauthenticated RCE. We reconstructed the path. CVE-2026-63030 kudos for discovering hashkitten Assetnote

One missing array entry started it all. then two WordPress core bugs chained through SQL injection, cache poisoning and an administrator identity switch -> ending in unauthenticated RCE. We reconstructed the path. CVE-2026-63030 kudos for discovering hashkitten Assetnote

BugBunny.ai - Continuous AI Pentesting System

15,935 views • 2 months ago

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

Calif

63,835 views • 2 months ago

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇

0xSha

28,781 views • 2 months ago

Watch us open the camera and uncover the anonymous identity behind Tor browser: We published the writeup for the browser RCE in IonStack. Mythos reported 271 bugs in Firefox 150 but still missed this one. And the Tor Browser is also affected by CVE-2026-10702. Update your Tor!

Watch us open the camera and uncover the anonymous identity behind Tor browser: We published the writeup for the browser RCE in IonStack. Mythos reported 271 bugs in Firefox 150 but still missed this one. And the Tor Browser is also affected by CVE-2026-10702. Update your Tor!

NebuSec

74,105 views • 1 month ago

The hallmark of our Government is to find long lasting and people-friendly solutions to challenges that have affected our nation for decades.

The hallmark of our Government is to find long lasting and people-friendly solutions to challenges that have affected our nation for decades.

Narendra Modi

708,363 views • 3 years ago

Yvonne: Where was Sakaja’s Green army all week to help the people at Grogan and other affected areas to clear the mud and water? Telling us about how you were affected by El nino is not what we want to hear; this is not about you Sakaja. Whilst we empathize with your experience, it is rather pointless #CitizenNewsGang Yvonne Okwara

Yvonne: Where was Sakaja’s Green army all week to help the people at Grogan and other affected areas to clear the mud and water? Telling us about how you were affected by El nino is not what we want to hear; this is not about you Sakaja. Whilst we empathize with your experience, it is rather pointless #CitizenNewsGang Yvonne Okwara

Citizen TV Kenya

40,702 views • 6 months ago

We just received a bounty reward from UniFi for reporting a vulnerability affecting UniFi OS devices. As part of the Hakai Labs (Hakai Offsec) research team at QuimeraX Intelligence, we independently identified a Path Traversal vulnerability (CVE-2026-34911) that allowed an attacker with network access to access internal routes on the underlying system without a valid token, exposing a sensitive information. Our research was conducted independently, but the vulnerability we reported could be chained with other vulnerabilities disclosed during the same period, including Improper Access Control and Command Injection flaws reported by other researchers. When combined, these issues lead to a pre-auth RCE affecting multiple UniFi OS products. Affected products include UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max, UCG-Fiber, and several other UniFi OS devices. We strongly recommend updating affected systems to the latest available version. Technical details remain under coordinated disclosure, and the only public information currently available is UniFi’s Security Advisory Bulletin.

We just received a bounty reward from UniFi for reporting a vulnerability affecting UniFi OS devices. As part of the Hakai Labs (Hakai Offsec) research team at QuimeraX Intelligence, we independently identified a Path Traversal vulnerability (CVE-2026-34911) that allowed an attacker with network access to access internal routes on the underlying system without a valid token, exposing a sensitive information. Our research was conducted independently, but the vulnerability we reported could be chained with other vulnerabilities disclosed during the same period, including Improper Access Control and Command Injection flaws reported by other researchers. When combined, these issues lead to a pre-auth RCE affecting multiple UniFi OS products. Affected products include UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max, UCG-Fiber, and several other UniFi OS devices. We strongly recommend updating affected systems to the latest available version. Technical details remain under coordinated disclosure, and the only public information currently available is UniFi’s Security Advisory Bulletin.

Carlos Vieira

37,588 views • 3 months ago

Kariba yarangarirwa 🔥🔥🔥🔥 This is the temporary vessel to service the route that has been affected by the recent tragedy. This is a small step while we wait for the arrival of a much bigger ferry. Our thoughts and prayers are still with the affected families 🙏🏿 #AsakhiZim

Kariba yarangarirwa 🔥🔥🔥🔥 This is the temporary vessel to service the route that has been affected by the recent tragedy. This is a small step while we wait for the arrival of a much bigger ferry. Our thoughts and prayers are still with the affected families 🙏🏿 #AsakhiZim

Shumbakadzi👑

19,931 views • 28 days ago

Visited traders affected by fire incidents at Toi Market and later at Umoja 2. Poleni sana to all affected and condolences to the bereaved. Sadly, we lost 4 souls in the Toi inferno. We will support their families during this trying time. For the traders, we will rebuild and help you get back to your feet. Thanks to the first responders and all who tried to help salvage the situation. We had a total of 7 fires across the city last night, and all affected will get support. For those who caused incitement, it is well, nothing will stop us from supporting our people.

Visited traders affected by fire incidents at Toi Market and later at Umoja 2. Poleni sana to all affected and condolences to the bereaved. Sadly, we lost 4 souls in the Toi inferno. We will support their families during this trying time. For the traders, we will rebuild and help you get back to your feet. Thanks to the first responders and all who tried to help salvage the situation. We had a total of 7 fires across the city last night, and all affected will get support. For those who caused incitement, it is well, nothing will stop us from supporting our people.

Sakaja Arthur Johnson

335,398 views • 2 years ago

Omo! This is quite relatable. The things that Japa has done! At least 75% of my friends have Japa’d, and making new friends now feels like a full-time job—where do you even start? In 2024 alone, I can’t count how many times my friends told me they were leaving Nigeria 🥲 Has Japa ever affected your friendships? Let’s really discuss what Japa does to relationships. How has Japa affected you and your loved ones? — Uncolored Podcast

Omo! This is quite relatable. The things that Japa has done! At least 75% of my friends have Japa’d, and making new friends now feels like a full-time job—where do you even start? In 2024 alone, I can’t count how many times my friends told me they were leaving Nigeria 🥲 Has Japa ever affected your friendships? Let’s really discuss what Japa does to relationships. How has Japa affected you and your loved ones? — Uncolored Podcast

Pamilerin Adegoke

143,198 views • 1 year ago

The Flemish activist Dries Van Langenhove gave a great speech at @resum25. He summarized our proposal for remigration: -Who is affected? -How does remigration work? Share the speech and follow him!

The Flemish activist Dries Van Langenhove gave a great speech at @resum25. He summarized our proposal for remigration: -Who is affected? -How does remigration work? Share the speech and follow him!

Remigration Summit

20,956 views • 1 year ago

Full Screen Friday 🔦⚡️ Vol. 16 #TezQuakeAid TezQuakeAid 💔 A community initiative to support those affected by the recent earthquake in Turkey and Syria. Shoutout to my friends for the live improv 🎙️ List of artists below 👇

Full Screen Friday 🔦⚡️ Vol. 16 #TezQuakeAid TezQuakeAid 💔 A community initiative to support those affected by the recent earthquake in Turkey and Syria. Shoutout to my friends for the live improv 🎙️ List of artists below 👇

Strano

27,882 views • 3 years ago

Anthony Jushua finally decided to retire from Boxing due to th3 recent acc¡d£nt that happened and took two of his best friends at the spot 😢😢😢. This is really a hard time for him and the families affected

Anthony Jushua finally decided to retire from Boxing due to th3 recent acc¡d£nt that happened and took two of his best friends at the spot 😢😢😢. This is really a hard time for him and the families affected

𝓞𝓫𝓼𝓮𝓻𝓿𝓪𝓽𝓲𝓸𝓷 𝓷𝓸 𝓫𝓮 𝓬𝓻𝓲𝓶𝓮

1,083,799 views • 8 months ago

Our thoughts are with all our friends around the world who were affected by community violence this weekend. You are not alone. When little ones hear about violent events on the news, it can be hard to help them understand and cope with what happened. Limiting media exposure and making space for them to express big feelings can help children feel safer and more secure. Check here for more free resources supporting families affected by violence:

Our thoughts are with all our friends around the world who were affected by community violence this weekend. You are not alone. When little ones hear about violent events on the news, it can be hard to help them understand and cope with what happened. Limiting media exposure and making space for them to express big feelings can help children feel safer and more secure. Check here for more free resources supporting families affected by violence:

Sesame Street

189,594 views • 9 months ago

The aftermath of a natural disaster is not the time for political games. We are working together with both Republican and Democratic officials to bring relief to those affected by Hurricanes Milton and Helene.

The aftermath of a natural disaster is not the time for political games. We are working together with both Republican and Democratic officials to bring relief to those affected by Hurricanes Milton and Helene.

Kamala Harris

522,319 views • 1 year ago

For production, a stronger cedi is a disadvantage. The appreciation of the cedi from 14 to 10 was not a good thing. It has affected our prices for export. - Mike Oquaye Jnr, Former NPP Parliamentary Candidate, Dome Kwabenya #TheKeyPoints #TV3GH

For production, a stronger cedi is a disadvantage. The appreciation of the cedi from 14 to 10 was not a good thing. It has affected our prices for export. - Mike Oquaye Jnr, Former NPP Parliamentary Candidate, Dome Kwabenya #TheKeyPoints #TV3GH

#TV3GH

55,870 views • 2 months ago

Day 3 of supporting Nairobi flood victims. The Sonko Rescue Team continues to work around the clock to assist affected families by facilitating the release of bodies from mortuaries and providing some financial support for burial expenses. We are still receiving and verifying cases at our offices to ensure that every family can give their loved ones a dignified send-off.Once we conclude handling the Nairobi cases, we shall extend our helping hand to other parts of the country to support families affected by floods who are facing similar challenges. Our thoughts and prayers remain with all the families affected during this difficult time. 🙏

Day 3 of supporting Nairobi flood victims. The Sonko Rescue Team continues to work around the clock to assist affected families by facilitating the release of bodies from mortuaries and providing some financial support for burial expenses. We are still receiving and verifying cases at our offices to ensure that every family can give their loved ones a dignified send-off.Once we conclude handling the Nairobi cases, we shall extend our helping hand to other parts of the country to support families affected by floods who are facing similar challenges. Our thoughts and prayers remain with all the families affected during this difficult time. 🙏

Mike Sonko

49,870 views • 6 months ago

The world of snooker acknowledging long-term issues following a Covid jab. Now it's time for the government to have an open discussion and to find ways to support those affected. Medical, psychological, and financial support is sadly lacking. Time for change.

The world of snooker acknowledging long-term issues following a Covid jab. Now it's time for the government to have an open discussion and to find ways to support those affected. Medical, psychological, and financial support is sadly lacking. Time for change.

VIBUK Official

24,058 views • 1 year ago

Indonesia’s government is resisting growing pressure to declare the devastating floods and landslides in Sumatra a national disaster, even as hundreds have died and thousands remain affected. Officials say the response is being handled at a national level, but the formal “national disaster” label has not been applied. Deaths: 824 Missing: 521 Injured: 2,700 Affected: 3.1 million Displaced: 592,800 Public Facilities Damaged: 536 Places of Worship Damaged: 185 Healthcare Facilities Damaged: 25 Buildings/Offices Damaged: 115 Educational Facilities Damaged: 326 Bridges Damaged: 295 Houses Damaged: 10,500 Regencies/Cities Affected: 51

Indonesia’s government is resisting growing pressure to declare the devastating floods and landslides in Sumatra a national disaster, even as hundreds have died and thousands remain affected. Officials say the response is being handled at a national level, but the formal “national disaster” label has not been applied. Deaths: 824 Missing: 521 Injured: 2,700 Affected: 3.1 million Displaced: 592,800 Public Facilities Damaged: 536 Places of Worship Damaged: 185 Healthcare Facilities Damaged: 25 Buildings/Offices Damaged: 115 Educational Facilities Damaged: 326 Bridges Damaged: 295 Houses Damaged: 10,500 Regencies/Cities Affected: 51

Volcaholic 🌋

138,899 views • 9 months ago