Threats · 1 day ago

CyberXero uses Claude Code to scale WordPress break-ins

SOCRadar says CyberXero has been running a two-track campaign since at least July 2026, using Claude Code to help automate WordPress and e-commerce break-ins while separately targeting Ukrainian energy and critical infrastructure. In the broad wave, the group accessed 429 WordPress admin panels and exfiltrated more than 628,000 records from four Ukrainian organizations.

The exposed working directory SOCRadar found included AI session logs, exploit tooling, reconnaissance output, and exfiltrated data. The automation matters because a single run scanned 4,708 targets, then moved from access to 32 web shells in 61 seconds, showing how quickly commodity web flaws and admin-panel takeovers can turn into post-exploitation.

For teams running WordPress, Support Board, or other internet-facing web apps, the exposure is not just the named Ukrainian targets: it is the speed at which an attacker can chain scanning, login or panel compromise, and shell deployment before normal response catches up. The same pipeline can stay useful for both broad opportunistic access and more selective intrusions against critical-infrastructure victims.

CVE-2026-60137

NVD KEV

Known exploited · CISA KEV

CVSS 5.9 MEDIUM: wordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the… EPSS 5% (92nd percentile).

CISA federal remediation date Aug 4 · date passed

CVE-2026-63030

NVD KEV

Known exploited · CISA KEV

CVSS 7.5 HIGH: wordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue…

CISA federal remediation date Jul 24 · date passed

CVE-2026-4815

NVD KEV

CVSS 8.8 HIGH: a SQL Injection vulnerability has been found in Support Board v3.7.7. EPSS 0.2% (14th percentile).

Timeline

Oct 12 Reported by The Hacker News
Aug 4 CISA federal deadline for CVE-2026-60137 passed
Jul 24 CISA federal deadline for CVE-2026-63030 passed
Jul 21 CVE-2026-60137 added to CISA KEV

Sources

1 source covering this story

The Hacker News Oct 12
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
CyberXero's Claude Code-assisted campaign accessed 429 WordPress admin panels and exfiltrated over 628,000 records from four Ukrainian organizations.

Entities

CVE-2026-63030
CVE-2026-60137
CVE-2026-4815
CyberXero

Part of the PlainSec briefing for 2026-10-13

Editions

Threats · 1 day agoCyberXero uses Claude Code to scale WordPress break-insSOCRadar says CyberXero has been running a two-track campaign since at least July 2026, using Claude Code to help automate WordPress and e-commerce break-ins while separately targeting Ukrainian energy and critical infrastructure. In the broad wave, the group accessed 429 WordPress admin panels and exfiltrated more than 628,000 records from four Ukrainian organizations.The exposed working directory SOCRadar found included AI session logs, exploit tooling, reconnaissance output, and exfiltrated data. The automation matters because a single run scanned 4,708 targets, then moved from access to 32 web shells in 61 seconds, showing how quickly commodity web flaws and admin-panel takeovers can turn into post-exploitation.For teams running WordPress, Support Board, or other internet-facing web apps, the exposure is not just the named Ukrainian targets: it is the speed at which an attacker can chain scanning, login or panel compromise, and shell deployment before normal response catches up. The same pipeline can stay useful for both broad opportunistic access and more selective intrusions against critical-infrastructure victims.