<div>CVE-2026-63030 + CVE-2026-60137 · Pre-auth WordPress Core RCE chain used as initial access to deploy Agent-TCP, a cross-platform Go RAT, across Windows & Linux — combined with mass IoT compromise across 14 CPU architectures, fileless execution via MemfdCreate, and DLL injection on Windows.<br><br>Affected: WordPress 6.9.0–7.0.1. Fixed: 7.0.2 / 6.9.5.