The Weekly Brief — Issue 010 (27 July 2026)

01 Patch Now

If your website runs WordPress, patch it today — "wp2shell" is being exploited now

On 17 July, WordPress disclosed two flaws in WordPress Core itself — not a plugin, not a theme — that can be chained together by an attacker with no account and no password to run their own code on your web server. Researchers named the chain "wp2shell". It combines CVE-2026-63030, a REST API batch-route confusion bug introduced in WordPress 6.9, with CVE-2026-60137, a SQL injection flaw in the author__not_in parameter of WP_Query present since 6.8.

Working proof-of-concept code appeared publicly within hours of disclosure, and on 21 July CISA added both flaws to its Known Exploited Vulnerabilities catalogue — the formal confirmation that they're being used in real attacks. The SQL injection affects 6.8.0–6.8.5, 6.9.0–6.9.4 and 7.0.0–7.0.1; the full remote-code-execution chain works on 6.9 and 7.0. Fixes are in 6.8.6, 6.9.5 and 7.0.2.

No login. No plugin required. Just a default WordPress install on the wrong version, sitting on the internet — and public exploit code that landed the same day.

Why it mattersMost NZ small businesses have a WordPress site somewhere, and it's the one system nobody owns — built by an agency years ago, quietly auto-updating (or not) ever since. A compromised site isn't just an embarrassing defacement: it becomes a launchpad for phishing under your own domain name, a place to host malware, and a reputation hit that torches your search rankings. Two things to do this week: check what version your site is running and get it to 6.8.6 / 6.9.5 / 7.0.2 or later, and check whether anyone is actually responsible for updating it. If the honest answer is "the web guy from 2021", that's the real finding. We're happy to check a site and tell you where it stands — no obligation.

Source: The Hacker News ↗

02 Threat Report

146 ransomware gangs and counting — and mid-sized businesses are the sweet spot

Security firm Black Kite published its 2026 Ransomware Report this week, and the headline finding is that the ransomware world has fragmented rather than shrunk. 61 new ransomware groups appeared between April 2025 and March 2026, taking the count of active groups to 146 by June 2026. The report tracked 7,551 victims over the period, with disclosures up 60% in the second half compared with the first.

The detail worth pausing on is who gets hit. The largest single share of victims were organisations turning over between USD 50 million and USD 100 million — not the giants, and not the corner dairy, but the established mid-sized firm with real revenue and a small IT team. Manufacturing was the most-targeted sector, followed by professional services, and 84.1% of victim postings landed on weekdays.

146active ransomware groups by June 2026 — up by 61 new entrants in a year, across 7,551 tracked victims (Black Kite 2026 Ransomware Report).

Why it mattersMore groups means more crews working the low end of the market: you no longer need to be interesting to a headline-grabbing gang to end up on a leak site. The mid-market revenue band that took the biggest share is exactly where a lot of solid New Zealand businesses sit — enough money to be worth extorting, rarely enough IT resource to have practised a recovery. The things that actually decide how bad a ransomware day gets are unglamorous: backups you have restored from recently (not just backups that report "successful"), MFA on every account including admins, and a written idea of who you ring first. If you can't remember the last time your backups were test-restored, that's the job for this quarter — and one we'll run with you.

Source: Black Kite via Help Net Security ↗

03 Business IT

Two Microsoft 365 deadlines that quietly break old scripts and office scanners

Microsoft has given administrators some breathing room on one deadline and is pressing ahead with another. On 17 July it confirmed that removing the -Credential parameter from Exchange Online PowerShell — the old way of connecting with a stored username and password — has been pushed back from July 2026 to December 2026. Microsoft's warning is blunt: scripts still using it "will break when you update to an Exchange Online PowerShell module version released beginning December 2026", and organisations should move now rather than wait.

Running alongside it is a change with a wider blast radius. Exchange Online is retiring legacy TLS 1.0 and 1.1 for POP3 and IMAP4 connections across 2026. Anything still connecting on those old protocols simply stops working; TLS 1.2 or later is required.

The device most likely to break isn't a PC. It's the office multifunction printer that emails scans to staff — set up years ago, on IMAP, and never touched since.

Why it mattersNeither of these is dramatic, and that's exactly the problem — nothing warns you until it stops working. The password-based PowerShell connection is a genuine security weakness (it's a stored password with mailbox access, usually outside MFA), so the extra months are a chance to move automation to modern app-based authentication rather than a reprieve. The TLS change quietly catches old printers/scanners, alarm and door systems, line-of-business apps and anything sending mail through a legacy connector. The fix is boring and cheap if you do it early: find what still uses POP/IMAP or a stored password, and update or replace it before it fails — usually mid-invoice-run, on a Friday. Ask us for a list of what's connecting the old way in your tenant.

Source: The Register ↗

04 NZ Compliance

NZ's biometric privacy rules stop being optional on 3 August

New Zealand's Biometric Processing Privacy Code, issued by the Privacy Commissioner in July 2025, came into force on 3 November 2025 — but organisations already using biometrics were given a nine-month grace period to get compliant. That transition period ends on 3 August 2026: next Monday.

The Code sits under the Privacy Act and sets the rules for any organisation that collects or uses people's biometric information — face, fingerprint, voice or iris data used to identify or categorise someone. It covers collection, use, disclosure, responding to access and correction requests, and storage, security, retention and disposal. An amendment in March 2026 folded in privacy principle IPP3A, effective 1 May 2026.

3 Aug2026 — the day the nine-month transition period ends and existing users of biometric technology must be fully compliant with the Biometric Processing Privacy Code.

Why it mattersMost businesses that fall under this don't think of themselves as "doing biometrics". If you run a fingerprint or face-scan time clock for staff, use facial recognition on site cameras, or have a voice-ID step in a phone system, you're in scope — and the grace period runs out on Monday. Worth checking before then: can you point to why the biometric option is proportionate (versus a swipe card or PIN), have you told people clearly what's collected and why, and do you know how long the data is kept and who can see it? Ask your supplier too — the obligation is yours, not the vendor's. If you're unsure whether something in your building counts, ask us and we'll tell you straight.

Source: Office of the Privacy Commissioner ↗

Tip of the week

Put your website on the patching list, not just your PCs

Almost every business we talk to can tell us who looks after their laptops. Far fewer can say who updates their website. That gap is exactly what story 01 exploits — and it's not only WordPress: the same blind spot covers plugins, themes, e-commerce add-ons, the hosting control panel and the domain itself. Three things worth writing down this week, one line each: who hosts the site, who has admin logins to it, and who is responsible for applying updates. Then turn on automatic updates for WordPress core (and keep automatic backups so you can roll back if an update misbehaves), remove plugins and themes you no longer use, and make sure every admin account has multi-factor authentication and belongs to someone who still works with you. It's a half-hour job that closes off a category of incident that is genuinely nasty to clean up — attackers who own your site can email your customers from your own domain. If you'd like us to look at yours and tell you what version it's on and what's out of date, just ask.

Node-Red

Want all of this handled for you?

We keep an eye on the threats, the updates and the fine print so you don't have to. Book a free, no-obligation IT checkup.

Book your free IT checkup