Imagine your house has a front door lock that’s completely broken. Not just a little broken—so broken that anyone can walk in without a key, without breaking anything, and without you even knowing they’re there.
That’s what just happened to 500 MILLION websites.
Two critical bugs were discovered in WordPress (the software that powers about 40% of all websites on the internet). These bugs are being actively exploited on a dark web forum called Omerta.top by hackers who are literally selling access to hacked sites.
What Are These Bugs? (The Technical Breakdown)
Bug #1 (CVE-2026-63030): The server gets confused about which request is which
- Think of it like a mail carrier who can’t tell which envelope goes to which house
- Hackers trick the server into running their malicious code instead of legitimate requests
Bug #2 (CVE-2026-60137): A SQL injection vulnerability
- SQL is the language databases use to store information
- Hackers can inject malicious commands into the database without needing a password
- It’s like having a secret back door to a filing cabinet
When Combined: These two bugs create what’s called “Remote Code Execution” (RCE)
- This means hackers can take complete control of a website’s server
- They can steal customer data, emails, credit card information
- They can install crypto miners to use your computer’s power
- They can install backdoors for future attacks
Why Is This Happening RIGHT NOW?
According to the omerta.top forum thread, a hacker group is actively selling exploit tools and services for $1,000 per setup. Here’s what’s concerning:
- The vulnerability was just made public — WordPress released patches, but…
- Not everyone updates immediately — Many website owners ignore security warnings
- Hackers are moving FAST — They’re scanning for vulnerable sites and exploiting them before patches are installed
- It’s being commercialized — People are literally selling “ready-to-use” hacking tools on dark web forums
The forum post even brags: “No password needed. No CAPTCHA. No bullshit.”
What Websites Are Vulnerable?
- WordPress versions 6.9.0 through 6.9.4
- WordPress versions 7.0.0 through 7.0.1
- That’s approximately 500+ million websites
Your school’s website? Your favorite gaming forum? That local pizza shop’s online ordering system? Any of them could be running vulnerable WordPress.
What Should YOU Do?
If You’re a Website Owner/Administrator:
- Update WordPress IMMEDIATELY — Don’t wait, don’t procrastinate
- Change all admin passwords — Assume hackers might already have access
- Block the vulnerable endpoint — Temporarily block
/wp-json/batch/v1at your firewall - Scan for backdoors — Check if hackers already installed hidden access points
- Monitor your database — Look for suspicious user accounts or data theft
If You’re Just a Regular Internet User:
- Use strong, unique passwords for every website
- Enable two-factor authentication wherever possible
- Monitor your accounts for suspicious activity
- Be suspicious of emails from affected websites asking you to reset passwords
- Check your credit reports if you’ve shopped on vulnerable sites
The Dark Web Connection
The forum thread we analyzed shows hackers:
- Openly advertising exploits for sale
- Offering “done-for-you” hacking services ($1,000 per setup)
- Providing source code for automated attacks using AI
- Confirming successful exploits in real-time
This isn’t theoretical. This is happening RIGHT NOW.
Why This Matters
This is a perfect example of why cybersecurity matters:
🔴 The Scale: 500 million websites affected
🔴 The Speed: Hackers move faster than website owners patch
🔴 The Commercialization: Hacking is now a business with customer service
🔴 The Automation: AI is being used to scale attacks
The Bottom Line
WordPress users need to update immediately. Website owners need to treat this as a crisis, not a suggestion. And regular internet users need to stay vigilant.
This is cybersecurity in 2026: vulnerabilities don’t stay secret for long, and when they go public, hackers weaponize them within hours.
Stay safe. Stay updated. Stay skeptical.
