7-Zip RCE Patch, WordPress wp2shell Exploits, and VMware Avi Bugs Lead Today’s Threat Digest

Top Stories

7-Zip fixes a remote code execution flaw tied to malicious archives

7-Zip version 26.02 fixes a remote code execution issue that can be triggered when a user opens a specially crafted archive, according to BleepingComputer (source).

Why it matters:
Archive handling bugs remain practical phishing initial access vectors. If your users routinely open ZIP, 7z, RAR, or mixed archive types from email, ticketing systems, or shared folders, this is a direct workstation risk.

What to do now: - Upgrade all managed endpoints running 7-Zip to 26.02. - Prioritize jump boxes, help desk systems, finance workstations, and developer endpoints. - Block or sandbox inbound archive attachments where possible. - Review email gateway telemetry for recent archive-heavy campaigns.

Technical Notes

Check Windows endpoints for installed 7-Zip versions:

Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "7-Zip*" } |
Select-Object DisplayName, DisplayVersion

Basic file discovery for suspicious recent archive payloads:

Get-ChildItem -Path C:\Users -Recurse -Include *.zip,*.7z,*.rar -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
Select-Object FullName, LastWriteTime

---

WordPress Core “wp2shell” flaws now have public exploits

Public exploit code is available for the critical WordPress Core “wp2shell” remote code execution issues, and admins are being urged to patch immediately (source).

Why it matters:
When public exploit code appears, opportunistic scanning usually follows quickly. Unpatched WordPress sites, especially those exposed directly to the internet, can move from “needs patching” to “actively targeted” within hours.

What to do now: - Patch WordPress Core immediately on all internet-facing sites. - Verify WAF rules and virtual patching coverage if patch rollout will lag. - Review admin user creation logs, plugin changes, and web shell indicators. - Force password resets and rotate application secrets if compromise is suspected.

Technical Notes

Quick version validation from the CLI:

wp core version

Look for recently modified PHP files in likely web shell locations:

find /var/www/html -type f -name "*.php" -mtime -7 | sort

Review suspicious POST activity in web logs:

grep -E 'POST .*wp-|/xmlrpc.php|/wp-admin|/wp-json' /var/log/nginx/access.log | tail -n 100

Potential indicators worth triage: - Unexpected admin account creation - New PHP files in /wp-content/uploads/ - Modified functions.php, wp-config.php, or .htaccess - Outbound connections from the web server to unfamiliar hosts

---

Microsoft warns of a surge in ACR Stealer attacks

Microsoft has warned customers about increased ACR Stealer activity targeting browser-stored passwords, authentication tokens, and documents (source).

Why it matters:
Infostealers are often the first stage of broader compromise. Stolen browser data can enable SaaS account takeover, MFA bypass via session theft, and downstream ransomware intrusion.

What to do now: - Hunt for suspicious browser credential access and token theft behavior. - Revoke active sessions for high-risk users. - Push users away from browser-stored passwords where possible. - Ensure EDR blocks credential dumping, suspicious process injection, and archive-delivered malware.

Technical Notes

Windows processes often worth correlating with browser data theft:

Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
Where-Object { $_.Message -match "chrome|msedge|firefox|login data|cookies" } |
Select-Object TimeCreated, Id, Message -First 20

Focus triage on: - Browser SQLite database access from non-browser processes - New scheduled tasks or Run keys - Unexpected child processes from Office apps, browsers, or archive managers - ZIP/7z-delivered JavaScript, HTA, or LNK payload chains

---

Analysts raise concerns about over-the-air auto technology risk

CNBC reports growing concern among analysts over cybersecurity risks tied to over-the-air software and feature updates in vehicles (source).

Why it matters:
For enterprise fleets, logistics operators, and manufacturers, OTA pipelines are part software supply chain and part safety system. Weak signing, poor segmentation, or insecure update channels can create outsized operational impact.

What to do now: - Validate code-signing and update verification controls in connected device programs. - Inventory externally reachable update management infrastructure. - Require strong separation between infotainment, telematics, and operational control domains. - Include OTA compromise scenarios in incident response tabletop exercises.

---

Privacy-preserving age verification gets attention

BleepingComputer highlighted on-device age verification approaches where biometric processing stays on the user’s device rather than being transmitted or centrally stored (source).

Why it matters:
As age verification requirements expand, organizations face a familiar security problem: compliance features can create new sensitive-data repositories. On-device models can reduce central biometric retention risk.

What to do now: - Minimize collection and retention of biometric or identity verification data. - Confirm data flow diagrams match actual implementation. - Review vendor contracts for storage, access, and deletion guarantees. - Treat age verification systems as privacy and security architecture decisions, not just compliance checkboxes.

Critical Vulnerabilities

CVE-2026-16117: Fastify HTTP Proxy prefix rewrite bypass

A critical flaw in @fastify/http-proxy allows encoded path segments to bypass expected prefix rewriting, potentially exposing upstream paths administrators intended to hide. Affected versions are up to and including 11.5.0. Upgrade to 11.6.0 (OpenJS Foundation advisory, GitHub advisory).

Risk:
This is especially relevant where Fastify is used as a path-based reverse proxy in front of internal admin or service endpoints.

What to do now: - Upgrade @fastify/http-proxy to 11.6.0. - Review reverse proxy routes that rely on rewritePrefix. - Test encoded path handling explicitly.

Technical Notes

Example of dependency checking:

npm ls @fastify/http-proxy

Upgrade command:

npm install @fastify/http-proxy@11.6.0

Proxy test idea:

curl -i 'https://proxy.example/%61dmin'

If route matching and upstream behavior differ when characters are URL-encoded, inspect rewrite logic immediately.

---

CVE-2026-47865: VMware Avi Load Balancer authentication bypass

VMware Avi Load Balancer contains an authentication bypass vulnerability that may allow a network-adjacent attacker to access the Avi control plane. Affected versions include 31.1.1 through 31.2.2, 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7. Fixed versions include 31.2.2-2p3 and 30.2.7 (Broadcom advisory).

Risk:
Anything exposing the control plane beyond tightly controlled admin networks should be treated as high priority.

What to do now: - Patch immediately. - Restrict management plane access with ACLs, VPN, and IP allowlisting. - Review recent control plane access logs for anomalies. - Rotate admin credentials if compromise is suspected.

CVE-2026-47871: VMware Avi Load Balancer directory traversal

A second Avi flaw allows authenticated directory traversal due to file path validation weaknesses. Affected versions include 32.1.1, 31.1.1 through 31.2.2, 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7. Fixed versions include 32.1.2, 31.2.2-2p3, and 30.2.7 (Broadcom advisory).

Risk:
This may not be as broadly severe as the auth bypass, but it compounds risk if an attacker already has access or can chain issues.

Technical Notes

For internet exposure review:

nmap -Pn <avi-controller-ip>

Operational checks: - Confirm management interfaces are not public - Review reverse proxies and load balancer admin exposure - Check for emergency firewall rules created during maintenance windows

---

CVE-2026-16095 and CVE-2026-16096: Shibby Tomato remote flaws

Two remotely reachable flaws affect Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124: - CVE-2026-16095: out-of-bounds write in /sbin/rc - CVE-2026-16096: stack-based buffer overflow in /proc/webmon_recent_domains

References: CVE-2026-16095, CVE-2026-16096

Risk:
The project is noted as superseded by FreshTomato, which means some organizations may still be running old firmware without an active modernization plan.

What to do now: - Identify any legacy Shibby Tomato deployments. - Isolate affected devices from untrusted networks. - Migrate to supported firmware and hardware where feasible. - Treat consumer-grade or community firmware in business environments as technical debt requiring review.

What Defenders Should Do Today

1) Patch the obvious high-risk items first

Prioritize: 1. WordPress Core instances exposed to the internet 2. 7-Zip on user endpoints 3. VMware Avi Load Balancer control plane systems 4. Fastify proxy deployments using rewritePrefix

A practical triage rule: patch systems that are both internet-reachable and support public exploit paths before lower-exposure assets.

2) Hunt for post-compromise signals, not just missing patches

Patching closes the front door, but today’s stories include multiple items where exploitation may already be underway or accelerated by public disclosure.

Focus hunting on: - New admin users in WordPress - Recently dropped PHP files or modified web content - Browser token theft and infostealer behavior - Unusual access to load balancer control planes - Reverse proxy route anomalies involving encoded paths

Technical Notes

Basic Linux web shell triage:

find /var/www -type f \( -name "*.php" -o -name "*.phtml" \) -mtime -3 -ls
grep -R --line-number "base64_decode\|eval(\|assert(\|shell_exec" /var/www 2>/dev/null

Recent auth and admin review on Linux systems:

last -a | head
grep -i "useradd\|sudo\|session opened" /var/log/auth.log | tail -n 50

3) Reduce credential and session theft exposure

Because ACR Stealer activity is rising, assume browsers and local profiles are soft targets.

Immediate steps: - Enforce phishing-resistant MFA where possible - Revoke sessions after infostealer alerts - Move privileged accounts to dedicated admin workstations - Reduce password storage in browsers for sensitive roles - Review SaaS logs for impossible travel, token reuse, and unfamiliar user agents

4) Review connected device and embedded risk

Today’s OTA vehicle story is a reminder that “cybersecurity threats” now routinely include software-defined systems outside classic IT.

Use today to: - Inventory update channels for managed devices - Validate signing and rollback protections - Confirm segmentation between management and operational networks - Document who can push updates and how approvals are logged

Final Take

The biggest immediate actions today are straightforward: patch 7-Zip, patch WordPress, and remediate VMware Avi exposure. At the same time, defenders should not overlook second-order risk. Infostealers like ACR Stealer can turn a single user click into broad SaaS compromise, and proxy or OTA design flaws can expose systems teams assumed were safely hidden.

For most organizations, the right move today is a mix of rapid patching, targeted threat hunting, and access reduction on high-value management surfaces.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.