How WP-SHELLSTORM Exposed 1.4M WordPress Sites

Reported 13 Jul 2026 by otx · Severity: medium

A financially motivated cybercrime group operating as WP-SHELLSTORM was exposed when their Python SimpleHTTPServer remained open for 22 days, revealing toolkits, logs, and target lists. The operation targeted over 1.4 million domains using 27 weaponized CVEs and deployed more tha