WordPress CVE-2026-87902 Exploited Within a Day of Patch, Honeypots Log Webshell Attempts

·5 views

A WordPress core vulnerability, CVE-2026-87902, was patched in version 7.1.2 and began seeing active attack traffic within roughly a day of disclosure. The flaw uses double-encoded directory traversal in the pagename parameter to include readable local PHP files without authentication, and can lead to remote code execution under certain theme and PHP configurations. Honeypot sensors in the Previdian network recorded 64 attempts from a single New Jersey host, which appeared to be an effort to install a web shell hosted on GitHub. Affected are WordPress releases below 7.1.2, and the campaign probed broadly rather than targeting a specific sector, so small and mid-sized sites are also at risk. Administrators are urged to update immediately and check for traversal requests, outbound fetches to code-hosting domains, and newly written PHP files.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Software Development Connects to Core Business Objectives

The article argues that business studies and software development are closely linked, since every application is built to solve a problem and meet specific business goals. It uses a restaurant management system to illustrate profitability, calculating profit as revenue minus expenses such as hosting, maintenance, and support. It then describes survival, using a property management startup that must cut costs and prioritize paying-customer features to stay afloat. The piece also examines prestige, explaining how reliability, security, and clean code shape a company's reputation with customers. The author suggests developers benefit from understanding the business context behind their technical decisions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What an AI agent cloud is and how the platform runs agents

An AI agent cloud is described as a set of managed services rather than a new kind of server, letting developers deploy small programs that process events and publish results. Each agent is a container image following a simple contract, and the platform provides compute, storage, networking, identity, and observability without requiring users to manage infrastructure. Agents are launched by the runtime when events arrive from a queue, webhook, or schedule, then scaled, monitored, and parked when idle. The runtime is designed to start agents quickly and handle large numbers of them efficiently, with average start times said to be under 200 milliseconds. The article also emphasizes that each agent runs in an isolated sandbox for security.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Scale-to-zero cuts cloud costs by billing only while code handles requests

Scale-to-zero changes cloud billing so that compute is charged only while an application is processing requests, not while a virtual machine merely sits running. When traffic stops, the platform pauses the instance and the compute meter drops to zero, and the next request wakes it up. In one example, about 84 percent of a customer's consumption came from a virtual machine that stayed on for every hour despite averaging under one vCPU of real work. Always-on instances accrue roughly 730 billable hours per month regardless of load, so even idle machines carry a fixed cost. The main trade-off is a short delay on the first request after an idle period, which is negligible for most APIs and internal tools but may matter for latency-critical or persistent-connection workloads.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Long-running AI agent workflows fail mid-task; checkpoint resumption is the real bottleneck

A DEV Community analysis of trending GitHub projects argues that long-running agent workflows are fragile because of how they handle failures. Three repos tackle different aspects: ruflo focuses on multi-agent swarm coordination, ECC on memory and security, and context-mode on context window optimization. The author contends that context window size is not the main constraint, since a failure partway through a multi-step workflow forces a restart unless state is checkpointed and can be resumed. The piece notes that most frameworks handle early steps well but struggle with later steps spanning hours or days. It promotes iflytek's astron-agent and astron-rpa as platforms that combine checkpoint-based persistence with orchestration and execution.

0 comments Read more at DEV Community