When a Single Request Breaks Everything: WordPress RCE, SonicWall 0-Days, and AI Attacks This Week

Emily Davis · 2026-07-20

You'd think a single request shouldn't be able to do this much damage. But this week, it did. Small inputs led to full code execution, memory loss, stolen encryption keys, and security tools that just stopped working. And the scary part? The paths attackers took were often surprisingly simple: exposed systems, weak checks, old drivers, fake prompts, and public code repurposed for malware delivery. Some of these bugs were brand new. Others were already being used in the wild before defenders even had a chance to patch. ### The WordPress RCE That Shouldn't Have Happened A remote code execution vulnerability in WordPress caught everyone's attention this week. It's the kind of bug that makes you wonder how it slipped through. Attackers could send a specially crafted request and gain control of a site without any authentication. For anyone running a WordPress site, this is a wake-up call. If you haven't updated to the latest version yet, stop reading and do that now. Seriously. It takes two minutes. ### SonicWall 0-Days: Old Drivers, New Problems SonicWall users had a rough week. Two zero-day vulnerabilities were disclosed, and one of them was already being actively exploited. The issue? Old drivers that didn't properly validate memory access. Attackers used these to crash systems or, worse, execute arbitrary code. If you're using SonicWall products, check for firmware updates immediately. This isn't one of those "patch when you have time" situations. ### AI Service Attacks: When Trust Becomes a Liability AI services are everywhere now, and attackers are taking notice. This week saw a rise in attacks targeting AI platforms through fake prompts and prompt injection. The idea is simple: trick the AI into revealing sensitive data or executing unintended actions. One attack vector involved public code repositories that contained malicious prompts disguised as legitimate examples. Developers who copied and pasted these into their workflows ended up exposing API keys and other secrets. It's a reminder that even smart tools can be fooled by clever inputs. ### SharePoint 0-Day: The Memory Loss Bug Microsoft SharePoint had its own moment in the spotlight with a zero-day vulnerability that caused memory corruption. Attackers could send a specially crafted file to a SharePoint server, and the server would lose track of what it was doing. This led to information disclosure and, in some cases, remote code execution. If you manage a SharePoint environment, apply the latest security patches from Microsoft. This one's being actively exploited. ### The Bigger Picture: Simple Paths, Big Consequences What ties all these incidents together? The attackers didn't need sophisticated exploits or nation-state resources. They used: - Exposed systems that should have been locked down - Weak input validation that let malicious data through - Old drivers with known memory issues - Fake prompts that tricked AI services into leaking secrets - Public code repositories that became delivery mechanisms for malware It's a reminder that security doesn't have to be complicated to be effective. Patching regularly, validating inputs, and being skeptical of public code can stop most of these attacks before they start. ### What You Can Do Right Now Here's a quick checklist based on this week's events: - Update WordPress to the latest version - Apply SonicWall firmware patches - Review AI service integrations for prompt injection risks - Patch SharePoint servers - Audit any public code you've imported recently None of these steps are hard. They just take a few minutes. But those minutes could save you from a breach that costs thousands of dollars and weeks of recovery time. ### Final Thought This week's news is a sobering reminder that attackers don't need complex plans. They just need one weak point. Your job is to make sure that weak point isn't yours.