eastbaycyber

Palo Alto Exploited, Chrome Zero-Day Patched, and Three Critical CVEs

Threat digests 7 min read
EC
East Bay Cyber Editorial Team Reviewed 2026-06-07

TL;DR - Active exploitation is targeting a critical WordPress plugin flaw. - Admins should patch Everest Forms Pro and review exposed services tied to new CVEs. - Urgency is high for internet-facing WordPress and edge-adjacent assets.

Top Stories

Critical Everest Forms Pro flaw exploited to take over WordPress sites

Attackers are actively exploiting CVE-2026-3300 in the Everest Forms Pro WordPress plugin, with the reported impact being full takeover of vulnerable sites, according to BleepingComputer (source).

Why this matters

WordPress plugin exploitation remains one of the fastest paths to initial access in SMB and mid-market environments. If a vulnerable plugin is installed on an internet-facing site, exploitation often requires little post-compromise effort to achieve:

  • administrator account creation
  • malicious plugin or backdoor deployment
  • content tampering or redirect injection
  • credential theft from stored configuration
  • lateral movement if the server is reused for other business apps

If your organization uses WordPress for marketing sites, customer portals, or internal publishing, this is not just a website integrity issue. It can become a broader infrastructure incident.

What to do now

  1. Identify all WordPress instances that run Everest Forms Pro.
  2. Update the plugin immediately to the fixed release referenced by the vendor or trusted advisory coverage.
  3. Review administrator accounts for unexpected additions.
  4. Inspect plugins and themes for unfamiliar files or recent changes.
  5. Rotate WordPress admin credentials and hosting panel credentials if compromise is suspected.
  6. Check web server logs for suspicious requests around plugin endpoints.

Technical Notes

Useful triage commands for Linux-hosted WordPress systems:

# Find WordPress installs
find /var/www /srv/www -type f -name wp-config.php 2>/dev/null

# Look for Everest Forms Pro plugin directories
find /var/www /srv/www -type d -iname "*everest*" 2>/dev/null

# Check recently modified plugin files in the last 7 days
find /var/www -path "*/wp-content/*" -type f -mtime -7 2>/dev/null | sort

# Search for suspicious PHP patterns often used in backdoors
grep -R --line-number --include="*.php" -E "base64_decode|eval\s*\(|assert\s*\(|shell_exec|system\s*\(" /var/www 2>/dev/null

Example Apache or Nginx log review:

# Recent requests containing common WordPress admin and plugin paths
grep -E "wp-admin|wp-login|wp-content/plugins" /var/log/nginx/access.log | tail -n 200

# Hunt for POST requests to plugin-related paths
grep 'POST' /var/log/nginx/access.log | grep -i 'everest'

Potential indicators to investigate:

- New administrator accounts created unexpectedly
- Unknown ZIP uploads in wp-content/uploads
- New PHP files under uploads, cache, or temp directories
- Outbound connections from the web server to unfamiliar hosts
- Modified .htaccess or index.php files

Critical Vulnerabilities

CVE-2026-11413: JD Cloud Box AX6600 stack-based buffer overflow

CVE-2026-11413 affects JingDong JD Cloud Box AX6600 4.5.3.r4546. The issue is described as a stack-based buffer overflow in the set_macfilter function of /sbin/jdcweb_rpc, with remote attack potential and a CVSS 8.8 score. Public disclosure and exploit availability were noted in the references (VulDB entry, reference package).

Why this matters

Consumer and prosumer networking gear frequently ends up in branch offices, remote worker environments, labs, and unmanaged shadow IT deployments. A remotely reachable flaw in router software can enable:

  • device takeover
  • traffic interception or redirection
  • persistence on edge infrastructure
  • pivoting into internal networks

Because these devices are often poorly inventoried, defenders should assume some exposure may exist outside standard enterprise asset lists.

What defenders should do

  • Inventory branch and home-office networking gear used for business access.
  • Check whether JD Cloud Box AX6600 devices are present in remote environments.
  • Restrict management exposure to trusted networks only.
  • Monitor for unexpected config changes, DNS changes, and new firewall rules on edge devices.
  • Prioritize replacement or patching if a vendor fix becomes available through official channels.

Technical Notes

If you manage Linux-based jump hosts or network monitoring systems, use them to identify potential exposure:

# Look for HTTP(S) admin interfaces in known remote subnets
nmap -Pn -p 80,443,8080,8443 192.168.0.0/16 --open

# Scan a defined branch-office range for common router ports
nmap -sV -Pn -p 80,443,22,23,8080,8443 10.20.0.0/24

Config and monitoring checks to consider:

- Unexpected changes to MAC filtering rules
- New admin sessions from unknown IP addresses
- DNS server values changed to unfamiliar addresses
- Port forwarding rules added without change tickets
- Firewall ACLs modified outside maintenance windows

CVE-2026-26422: clash-verge-service-ipc local privilege escalation

CVE-2026-26422 affects clash-verge-service-ipc before 2.3.0. The flaw is a world-reachable IPC endpoint that can lead to local privilege escalation, with a CVSS 8.4 score. Relevant references include the fixing commit, release page, and write-up (commit, release, analysis).

Why this matters

Local privilege escalation bugs are especially relevant on:

  • shared developer workstations
  • VDI environments
  • BYOD-adjacent admin systems
  • endpoints already exposed to commodity malware

Even if initial access is low-privilege, an IPC service reachable by non-privileged local users can turn a modest compromise into full host control.

What defenders should do

  • Upgrade clash-verge-service-ipc to 2.3.0 or later.
  • Identify endpoints where the service is installed, especially engineering and power-user systems.
  • Hunt for unusual child processes or service invocations tied to the IPC component.
  • Review local admin group membership on affected systems.
  • Treat unpatched systems as post-exploitation enablers if other malware is present.

Technical Notes

On Linux endpoints, validate package or binary versions:

# Example: locate the binary or service files
find / -type f -iname "*clash*verge*ipc*" 2>/dev/null

# Example: inspect systemd units that may reference the service
systemctl list-unit-files | grep -i clash
systemctl status clash* --no-pager

On systems with process telemetry, investigate:

Parent process: untrusted user application
Child process: privileged helper or service action
Signal: non-admin user triggering actions through IPC endpoint

Basic host review ideas:

# Recent service changes
journalctl --since "7 days ago" | grep -i clash

# Suspicious privilege-related logs
journalctl --since "7 days ago" | grep -Ei "permission|denied|sudo|pkexec|polkit"

What Defenders Should Do Today

1) Patch internet-facing WordPress first

The highest operational risk in this digest is the active exploitation of Everest Forms Pro. If you only have time for one action today, make it this:

  • patch affected plugin instances
  • review logs for exploitation attempts
  • verify no rogue admins or web shells were added

2) Validate asset exposure beyond your CMDB

The router-related CVE is a reminder that not all risk lives in formally managed infrastructure. Review:

  • branch office equipment
  • executive or VIP home-office setups
  • lab devices
  • marketing and shadow IT hosting

3) Reduce the blast radius of local privilege escalation flaws

For endpoint-side privilege escalation issues like CVE-2026-26422:

  • remove unnecessary local admin rights
  • isolate development tools from privileged workflows
  • deploy EDR rules for suspicious service abuse
  • prioritize patching on shared or high-value endpoints

4) Hunt for signs of exploitation, not just vulnerable versions

Version-based exposure is only half the story. Defenders should also look for:

- New or unknown admin accounts
- Unexpected scheduled tasks or cron jobs
- Modified service definitions
- New listening ports
- Outbound traffic to rare destinations
- File changes in application and plugin directories

Analyst Take

Today’s most actionable item is the active WordPress exploitation reported by BleepingComputer (source). The other two CVEs are worth immediate scoping, but they are not in the same category of urgency unless you know the affected software or hardware exists in your environment.

In practical terms:

  • WordPress admins: patch and review for compromise
  • Network teams: inventory edge devices and management exposure
  • Endpoint teams: upgrade clash-verge-service-ipc where present
  • SMBs: use this as a prompt to close asset inventory gaps

Sources

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-06-07

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.