Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites

WP-SHELLSTORM is a financially-motivated webshell access brokerage whose operator left an unsecured server that exposed webshells, exploit scripts, scan results and target lists covering ~1.4M domains; researchers validated thousands of compromised WordPress/Joomla sites and recovered tooling (obfuscated down.php, SNOWLIGHT dropper, VShell) plus evidence of earlier credential theft from Nacos instances — the disclosure includes exploited CVEs, IoCs (IPs/domains, webshell filenames, process artefacts) and prioritized patching/hunt guidance.