WAF Watch: Click2Shell, Feide DDoS, Magento cleanup

Mac Clark · September 21, 2026

A short roundup of what hit websites this past week — and what to do about it if you run campus or agency sites. Fear is cheap; checklists are useful. Mid-week Watch covered WooCommerce webshells, Drupal CKEditor, and miniOrange SAML. Here’s what landed since then, plus one availability lesson that isn’t a CVE.

ProtectMyWebsite is the WAF that tells you what’s safe to block — rules start in count, then your dashboard shows what to promote. You still decide.

1. WordPress core — Click2Shell forced theme install (fixed in 7.1.1)

On September 17 WordPress shipped 7.1.1, a security-and-maintenance release with eleven security fixes. The headline for operators is the issue pwn.ai / Paulos Yibelo named Click2Shell: a specially crafted URL, opened by a logged-in administrator, can automatically install and preview an inactive theme from the WordPress.org directory — without anyone clicking Install. WordPress 7.1.1 release, Patchstack (Sep 18), and The Hacker News (Sep 18) covered the chain.

Alone, the core bug installs a real catalog theme (site appearance may not change). Researchers showed a chain to code execution when that theme also exposes an insecure AJAX handler (their PoC used Mobile Repair Zone’s download path). WordPress’s own release note frames it as: specially crafted URLs can automatically install and preview an inactive theme. No public CVE id yet; no confirmed in-the-wild exploitation reported in those write-ups. Fixes are being backported across supported branches back to 4.7 — but only the current line is actively maintained.

Campus / agency angle: departmental microsites where one faculty or agency admin stays logged in all day, plus any property that still allows theme installs from the dashboard.

Do this: Update every WordPress estate to 7.1.1 (or the matching security backport for your branch) immediately. Where policy allows, prefer DISALLOW_FILE_MODS on production so theme/plugin installs can’t land from a drive-by admin click. Sweep for unexpected inactive themes and unknown plugins. At the edge, put signatures for theme-install / theme-preview admin paths and odd Customizer AJAX downloads in count first — promote when hits look like probes, not a real theme preview by your web team.

2. Norway higher education — Feide / Sikt DDoS hits shared campus login

On September 14, University of Bergen’s IT status cards and Khrono reported another tjenestenektangrep (DDoS) against Sikt services, with Feide unstable from about 10:00 local. Feide is Norway’s national education/research login fabric — when it wobbles, Studentweb, Søknadsweb, FS Admin, Cristin, Samordna opptak, and anything else that federates through Feide can go with it. Khrono noted this as the latest in a series that started in late August; earlier waves also hit shared student systems and educloud. Coverage did not describe a data breach — availability and authentication dependency are the operator lesson. UiB help card KI-3676 (Sep 14) and Khrono have the public notes.

Campus / agency angle (including outside Norway): shared IdP / national SSO is a single front door. When that door is under flood, every “local” student portal still looks broken to users.

Do this: Know which of your properties hard-depend on a shared SSO vs which can degrade to a status page or secondary IdP. Keep a public status owner and a VPN / alternate-login path documented for off-network staff. Rate-limit and challenge auth/ACS paths in count so recovery traffic and scanners don’t collide when the IdP comes back. Origin IPs stay off the public internet.

3. Magento / Adobe Commerce — StyleSmuggler cleanup is still the job (CVE-2026-75650)

CVE-2026-75650 (StyleSmuggler) — unauthenticated RCE, CVSS 10.0 — was already in our earlier Watch when Adobe shipped hotfix VULN-39341 (APSB26-146) and CISA added it to KEV. Sansec’s ongoing write-up (last updated September 14) is why it stays on this week’s checklist: phishing-caliber implants rename themselves (fc-cache, chronyd), secondary web shells land under pub/media, and patching alone does not clean a store that was hit in the pre-hotfix window. Adobe’s guidance still stands: apply the hotfix, then rotate the encryption key and every credential that key protected (admin passwords, integration tokens, OAuth secrets, payment-gateway keys at the provider, DB/SSH/deploy keys, extension API keys). Key rotation inside Magento does not revoke secrets an attacker already copied out. Sansec StyleSmuggler research, CISA KEV alert (Sep 8), and the Tenable FAQ have the operator detail.

Campus / agency angle: bookstore, ticketing, foundation shop, and any “temporary” Magento microsite that never made the central CMS inventory.

Do this: Confirm VULN-39341 is applied (`vendor/bin/magento-patches -n status | grep 39341`). Hunt for unexpected PHP under pub/media, odd background processes, and bursts of “Payment Transaction Failed Reminder” mail. Complete Adobe’s credential-rotation checklist even if the hotfix looks clean. At the edge, keep GraphQL / PayPal response / template-style probe signatures in count; promote when traffic looks like scanners, not real checkout.

4. The Events Calendar — second unauth RCE chain; patch target is now 6.17.4.1 (CVE-2026-78006)

Monday’s Watch covered CVE-2026-78159 and pointed estates at 6.17.3.1+. WPScan / Patchstack also track a second unauthenticated PHP object-injection → RCE path, CVE-2026-78006, affecting ≤ 6.17.4, fixed in 6.17.4.1. Same plugin class, same comment/do_blocks shape: crafted widget markup in event comments can reach deserialization when comments are enabled and visible on tribe_events. WPScan’s entry was last updated September 18. WPScan CVE-2026-78006, Patchstack (≤6.17.4), and Prior Watch (Sep 14) have the first-chain write-up.

Do this: Do not stop at 6.17.3.1 — land 6.17.4.1+ everywhere The Events Calendar runs. If you cannot patch today, disable (or tightly moderate) comments on all tribe_events posts. Sweep pending comments for unexpected wp:legacy-widget / block markup. Keep body-aware virtual-patch rules for comment injection in count; promote only after probe traffic is obvious.

Tip of the week

Admin-session CSRF and shared SSO outages are why count mode exists.

This week’s WordPress item is not a pretty anonymous URL exploit — it needs a logged-in administrator to open a crafted link (or an XSS that fires in that session). The Magento item is the opposite shape: unauthenticated probes against GraphQL and payment paths that still deserve careful promotion so you don’t break checkout. The Norway item isn’t a CVE at all — it’s a reminder that when shared login floods, every app behind it looks “down.” The wrong move is flipping every new signature to deny on day one and locking out Monday-morning faculty editors or bookstore customers. The right move:

Deploy (or request) virtual-patch rules that cover admin theme-install / preview paths, GraphQL and payment callbacks, and SSO ACS / login abuse shapes — not only pretty URLs.
Leave them in count against real traffic.
After about a day, open the dashboard — it shows what’s safe to block.
One click to promote. You stay in the loop.

That’s how we run ProtectMyWebsite: rules start in count; after 24 hours the dashboard shows what’s safe to block — one click. Promote Copilot reads your count window and explains why a rule looks safe — or why to hold / allowlist — in plain English for campus and agency operators. You stay in the loop — you still click once. Copilot explains only — no auto-block.

Self-serve is $150/site/mo with a 14-day trial. Refer a peer: both sides get 10% off for 3 months.

If you run a multi-site estate (main site + departmental CMS + shop + SSO), ask about Campus Estate: quote on request — talk to sales team. We do not publish Estate list prices. Your inventory drives the conversation.

If you run campus or agency sites: scan your site, see what WAF count mode is, what's safe to block on a WAF, managed WAF for university and college websites, managed WAF for government and public-sector websites, Prior Watch (Sep 16), Prior Watch (Sep 14), and start a 14-day trial.