Chinese Hackers Hit 49 Orgs, 996 Zyxel Devices [2026]

A Chinese-speaking threat actor has spent weeks breaking into government systems and small business networks worldwide by chaining two unrelated bugs: a WordPress plugin exploit and a stack-based buffer overflow in Zyxel network switches. Security researchers at GreyNoise disclosed the campaign on September 22, 2026, describing a coordinated effort that has already pulled sensitive records out of at least one Western government agency and compromised nearly 1,000 network devices across dozens of countries.

The campaign is notable less for any single flaw and more for how the pieces fit together. Attackers used a WordPress exploit chain researchers have named wp2shell to gain footholds on public-facing sites, then separately hammered internet-exposed Zyxel switches with a newly weaponized remote code execution bug. Two different attack surfaces, two different vendor ecosystems, one operator moving between them. That’s the part that has incident responders paying close attention this week.

What Happened: The WordPress Side of the Attack

The WordPress portion of the campaign relies on an exploit chain tracked as wp2shell, built around two vulnerabilities: CVE-2026-63030 and CVE-2026-60137. Reports describing the chain say it lets an attacker plant a web shell on a vulnerable WordPress installation, giving them persistent remote access to the underlying server without needing valid credentials first.

According to GreyNoise, the WordPress side of the operation has hit at least 49 organizations across 29 countries. The victim profile skews toward government agencies and small businesses, the kind of targets that often run WordPress for public information pages but don’t have dedicated security teams watching for exploit chains like this one. From one Western government organization alone, researchers say the attackers pulled at least 18,566 sensitive records, including accounts, plaintext passwords, and personally identifiable information tied to law-enforcement and government personnel.

Plaintext password storage inside a government system is its own separate failure, one that predates this specific intrusion but made it far more damaging once the door was open. A web shell alone gets an attacker a foothold; a database full of unhashed credentials turns that foothold into a mass-credential-theft event with knock-on risk for every other system where those passwords might be reused. It echoes a pattern seen in the Florida DMV breach, where a single point of failure exposed hundreds of thousands of records.

The Zyxel Side: A Second, Separate Campaign Hitting the Same Kind of Target

Running in parallel, the same threat cluster (or a closely associated one, per the researchers’ description) has been exploiting CVE-2026-7273, a stack-based buffer overflow in ZyXEL GS1900 Smart Managed Switches that allows unauthenticated remote code execution through crafted HTTP requests. The bug carries a CVSS score of 8.8, high severity, and importantly, it does not require any login to trigger.

GreyNoise says exploitation activity against the Zyxel bug began around August 17, 2026, and by the time researchers published their findings, it had already reached 996 devices across 48 countries. That’s a wide, fast spread for a hardware-level bug, and it points to automated scanning-and-exploitation tooling rather than manual, device-by-device targeting.

Once inside a switch, the attackers reportedly pulled device configurations, network topology information, and hashed root-level credentials. Unlike the WordPress side, these credentials were hashed rather than stored in plaintext, but a compromised network switch configuration is valuable on its own: it hands an attacker a map of the internal network sitting behind that device, including subnets, VLANs, and routing details that would otherwise take real reconnaissance effort to piece together.

One detail stands out. GreyNoise found that 564 of the affected ZyXEL devices were still running factory-default credentials at the time of compromise. More than half of the total victim population never bothered to change the password that shipped in the box. That’s not a zero-day problem, that’s a configuration-hygiene problem, and it turned what should have been a contained exploit into a much larger foothold, not unlike the credential exposure behind 9,300 leaked AWS keys still granting admin access earlier this year.

Why Researchers Are Calling This a First

GreyNoise reportedly described its findings as the first publicly documented exploitation of CVE-2026-7273 in the wild. Vulnerability disclosures happen constantly, but the gap between a CVE being published and someone using it against real targets can range from days to never. When a research firm confirms it’s watching the first live exploitation of a specific bug, that’s a signal to every defender still running the affected hardware: the theoretical risk just became an active one.

The report also flags, with appropriate caveats, that the attackers may have targeted Ubiquiti network equipment as part of the same broader operation. Specific models, vulnerabilities, and victim counts for the Ubiquiti angle remain unconfirmed in the current reporting, so treat that thread as a lead to watch rather than a settled fact. Researchers are also weighing whether the group used a large language model to help build or refine its custom exploitation tooling, another detail that remains unconfirmed but consistent with a broader trend of threat actors experimenting with AI-assisted tool development.

By the Numbers: The Two-Pronged Campaign

Metric	WordPress (wp2shell)	Zyxel GS1900 (CVE-2026-7273)
Tracked CVEs	CVE-2026-63030, CVE-2026-60137	CVE-2026-7273
CVSS severity	Not separately scored in reporting	8.8 (High)
Confirmed victims/devices	49 organizations	996 devices
Countries affected	29	48
Data reportedly taken	Accounts, plaintext passwords, PII	Configs, network data, hashed root credentials
Largest single-victim record count	18,566 records (one government org)	Not disclosed per-device
Devices on factory-default credentials	Not applicable	564 of 996
Exploitation start (approx.)	Unconfirmed exact date	Around August 17, 2026

Who Is Behind It

Researchers describe the operators as a Chinese-speaking threat actor, based on tooling, infrastructure, and behavioral patterns observed during the intrusions. That phrasing is deliberate and worth sitting with: “Chinese-speaking” is an attribution based on linguistic and technical artifacts, not a confirmed link to a specific named group or a government sponsor. No specific group name or nation-state attribution has been confirmed in the current reporting, and readers should treat any claim beyond “Chinese-speaking threat actor” as speculation until named outlets confirm it.

This kind of cautious attribution is standard practice among serious threat intelligence teams, and it’s a meaningfully different bar than naming, say, a known APT group with a tracked history. It also means organizations defending against this activity should focus on the technical indicators, the specific CVEs, the wp2shell tooling signatures, the exploitation patterns against Zyxel switches, rather than waiting for a definitive attribution before patching. State-linked actors misusing widely available tools is a recurring theme this year, as seen in reports of Iran, Russia, and China misusing AI tools across six continents.

Historical Context: Edge Devices Keep Being the Weak Link

Placed alongside other recent high-severity network and web-facing vulnerabilities, this campaign fits a clear pattern: unauthenticated remote code execution bugs in edge infrastructure keep getting exploited within weeks of disclosure, and factory-default or reused credentials keep multiplying the blast radius once attackers get in.

Recent flaw	Vector	CVSS	Confirmed active exploitation
CVE-2026-7273 (Zyxel GS1900)	Unauthenticated RCE via crafted HTTP requests	8.8	Yes, since ~Aug 17, 2026
wp2shell chain (CVE-2026-63030 / CVE-2026-60137)	WordPress web shell chain	Not separately scored	Yes, 49 organizations hit
VMware vCenter (CVE-2026-59310)	Enterprise virtualization RCE	9.8	Yes, tied to ransomware activity
N-able N-central (CVE-2026-86218)	RMM platform RCE	10.0	Patched after 4th hotfix in 5 weeks

This campaign fits a pattern that has repeated across the past several years: network edge devices, the routers, switches, and VPN appliances sitting at the boundary of a network, are consistently the softest targets for state-linked and financially motivated actors alike. Firewalls and switches often run for years without firmware updates because taking them offline for patching means network downtime, so administrators postpone it. Combine that with default credentials nobody rotated, and you get exactly the kind of soft target the Zyxel exploitation chain found: nearly a thousand devices, more than half never reconfigured past their factory settings.

WordPress carries a parallel, older problem. It powers a huge share of the public web, including a long tail of government and small-business sites maintained without dedicated security staff. A plugin or core vulnerability that turns into a working exploit chain, like wp2shell reportedly does with CVE-2026-63030 and CVE-2026-60137, doesn’t need to be sophisticated to be effective. It just needs a large enough population of unpatched, low-attention targets, and WordPress has always supplied that at scale.

What’s changed is the pairing. Instead of running one campaign against one platform, this operation appears to run two simultaneous exploitation tracks against two completely different technology stacks, content management systems on one side, network hardware on the other, aimed at overlapping victim types. That’s a resourcing signal. Running two live exploit chains at once against dozens of countries takes infrastructure, target lists, and operational bandwidth that a small crew typically doesn’t have.

Market and Sector Impact

The immediate impact lands hardest on public-sector IT teams and the vendors that serve them. Government agencies running self-hosted WordPress sites now have a concrete reason to audit plugin inventories against CVE-2026-63030 and CVE-2026-60137 this week, not next quarter. Managed service providers that handle patching for small government clients and small businesses are likely facing a wave of client calls, since this is exactly the segment GreyNoise flagged as disproportionately affected.

For network hardware, the exposure is broader than one vendor. Zyxel’s GS1900 line is a budget-friendly, widely deployed switch series used by small offices, schools, and municipal networks precisely because it’s affordable and easy to set up, which also explains why so many units were left on factory-default logins. Expect increased scrutiny of similar budget-tier network hardware across the industry, and expect vendors in that price segment to face pressure to ship forced credential-rotation prompts on first boot, a feature higher-end enterprise gear has had for years. It’s a similar dynamic to the exposure created by unpatched cloud infrastructure, like the GKE multi-cloud flaw that put cross-project access at risk despite zero confirmed exploits at disclosure time.

The unconfirmed Ubiquiti angle, if it firms up in coming days, would widen the blast radius further. Ubiquiti’s UniFi line sits in a similar market position: affordable, widely deployed, popular with small IT teams managing multiple sites remotely. If the same actor is probing that ecosystem too, the story shifts from “two vulnerabilities” to “a systematic sweep of budget network infrastructure,” which is a meaningfully bigger story for enterprise risk teams to plan around.

Competitive and Vendor Response Landscape

Zyxel maintains a public security advisories page where patches and mitigation guidance for CVE-2026-7273 should appear as the company responds to GreyNoise’s disclosure. Organizations running GS1900 switches should check that page directly rather than relying on secondhand summaries, since advisory content and patch availability can change quickly once a vendor confirms active exploitation.

On the WordPress side, the response is more fragmented by design. WordPress core itself, plugin maintainers, and hosting providers all share responsibility for closing the wp2shell chain, and the WordPress.org news feed is the fastest place to track official guidance as it lands. Because CVE-2026-63030 and CVE-2026-60137 involve a chain rather than a single flaw, site owners may need to confirm patches for multiple components before they can consider themselves protected, not just one plugin update.

Security researchers including GreyNoise, whose research blog carries ongoing updates on this and related campaigns, have positioned themselves as the early-warning layer here, publishing exploitation telemetry well ahead of formal vendor patch cycles in some cases. That’s become a familiar rhythm in vulnerability disclosure: threat intelligence firms detect and publicize active exploitation, which then pressures vendors and downstream users to move faster than a standard patch-Tuesday cadence would allow.

Technical Breakdown: How wp2shell Reportedly Works

While full technical details of the wp2shell chain haven’t been published in a way that would let defenders reproduce it (appropriately, given active exploitation), the reported pattern follows a familiar shape for WordPress compromise chains: identify a vulnerable component through CVE-2026-63030, use it to gain an initial write primitive or authentication bypass, then chain into CVE-2026-60137 to escalate that access into full remote code execution and drop a persistent web shell.

The naming, wp2shell, describes the outcome rather than the mechanism: WordPress to shell access. Once a shell is planted, the attacker no longer needs to re-exploit the original vulnerabilities. They have a standing backdoor that survives as long as it goes undetected, which is exactly how a single exploited site turns into weeks or months of quiet data exfiltration, the kind that produced the 18,566-record haul from one government target.

Technical Breakdown: The Zyxel Buffer Overflow

CVE-2026-7273 is described as a stack-based buffer overflow triggered through crafted HTTP requests to the switch’s management interface, leading to unauthenticated operating-system command execution. That combination, no authentication required plus OS-level command execution, is about as severe as a device-level bug gets short of a full remote wipe capability. It explains the 8.8 CVSS score and why GreyNoise moved quickly to publicize findings once exploitation was confirmed.

Stack-based buffer overflows in embedded network device firmware are a persistent category of bug because these devices often run lightweight, stripped-down web servers for their management interfaces, code that doesn’t get the same scrutiny or hardening as, say, a modern web application framework. Reference points like the FIRST.org CVSS calculator help standardize how severe a given flaw is, but the score alone doesn’t capture how much easier these bugs are to find in embedded firmware than in actively maintained software with a large security research community poking at it. Enterprise-grade appliances face the same exposure window, as shown by the recent VMware vCenter RCE that hit CVSS 9.8 and was already being used in live ransomware attacks.

What Defenders Should Do Right Now

For WordPress administrators, the priority list is straightforward: audit installed plugins and core version against CVE-2026-63030 and CVE-2026-60137, check server logs for unfamiliar file writes or unexpected PHP files in upload directories, and rotate all credentials stored on the server, especially if there’s any chance they were stored in plaintext. Government IT teams in particular should treat any WordPress instance handling personnel data as a priority audit target this week.

For anyone running ZyXEL GS1900 switches, the fix is more direct: confirm the device isn’t reachable from the open internet on its management interface, change any factory-default credentials immediately (remember, 564 of the 996 compromised devices never had this done), and check Zyxel’s advisory page for a firmware patch addressing CVE-2026-7273. Network segmentation that keeps switch management interfaces off the public internet entirely would have prevented this specific exploitation path regardless of the underlying bug. Formal tracking through resources like CVE.org is worth bookmarking for anyone responsible for patch management across mixed vendor fleets.

# Quick self-check for exposed Zyxel management interfaces
# Run from an external network to see what an attacker sees
nmap -p 80,443,8080 --script http-title your-public-ip-range

# Check WordPress for unexpected admin users or files
wp user list --allow-root
find /var/www -name "*.php" -mtime -30 -newer /var/www/wp-config.php

Predictions: Where This Goes Next

Zyxel will publish a firmware patch for CVE-2026-7273 within days of this disclosure, given the confirmed active exploitation and CVSS 8.8 severity, but a meaningful share of the 996 already-compromised devices will remain unpatched for months due to update-adoption lag typical of budget network hardware.
The unconfirmed Ubiquiti targeting thread will likely firm up into named CVEs within the coming weeks as GreyNoise and other researchers continue tracking the same infrastructure and tooling.
Expect at least one more government agency, beyond the unnamed Western organization already confirmed, to disclose exposure tied to the wp2shell chain as incident response teams comb through logs following this public disclosure.
Scrutiny of factory-default credentials on network hardware will intensify, and it would not be surprising to see calls for mandatory forced-password-change-on-first-boot requirements from regulators or industry standards bodies overseeing government IT procurement.
Attribution will likely remain at “Chinese-speaking threat actor” for an extended period rather than resolving to a named group, consistent with how long attribution investigations typically take absent a clear operational-security mistake by the attackers.

The Bigger Picture

What makes this campaign worth tracking closely isn’t the individual severity of either bug. CVE-2026-7273 is serious but not unprecedented, and WordPress exploit chains happen with some regularity. It’s the combination: one actor running parallel exploitation tracks across two unrelated ecosystems, hitting overlapping government and small-business targets, and pulling both plaintext credentials from web applications and hashed credentials plus network topology from hardware. That’s a broader reconnaissance and access strategy, not an opportunistic smash-and-grab.

For the security community, this is also a reminder that “government target” doesn’t automatically mean “hardened target.” A single government organization losing 18,566 records through a WordPress web shell, and hundreds of network switches sitting on factory-default passwords, both point to the same underlying gap: basic hygiene practices, patching cadence and credential rotation, remain the most common failure point even against attackers using genuinely novel exploitation techniques.

Frequently Asked Questions

What is wp2shell?

wp2shell is the name researchers gave to a WordPress exploit chain built around CVE-2026-63030 and CVE-2026-60137, which together allow an attacker to plant a persistent web shell on a vulnerable WordPress site without needing valid login credentials.

What is CVE-2026-7273 and how severe is it?

CVE-2026-7273 is a stack-based buffer overflow in ZyXEL GS1900 Smart Managed Switches that allows unauthenticated remote code execution through crafted HTTP requests. It carries a CVSS score of 8.8, classified as High severity.

How many organizations and devices were affected?

Researchers at GreyNoise say the WordPress campaign hit at least 49 organizations across 29 countries, while the Zyxel campaign compromised 996 devices across 48 countries.

Who is behind these attacks?

Researchers describe the operator as a Chinese-speaking threat actor based on observed tooling and infrastructure. No specific group name or confirmed nation-state sponsor has been publicly attributed as of this report.

What data was stolen?

From the WordPress side, reports describe accounts, plaintext passwords, and personally identifiable information tied to law-enforcement and government personnel, including at least 18,566 records from one Western government organization. From the Zyxel side, attackers reportedly took device configurations, network information, and hashed root-level credentials.

Is there a patch available for CVE-2026-7273?

Organizations should check Zyxel’s official security advisories page directly for the latest firmware patch status, since advisory guidance can change quickly following active-exploitation disclosures like this one.

Were Ubiquiti products also targeted?

Reports indicate the same threat cluster may have also targeted Ubiquiti network equipment, but specific vulnerabilities, models, and victim counts for that angle remain unconfirmed at this time.

What should administrators do immediately?

WordPress administrators should audit for CVE-2026-63030 and CVE-2026-60137, check for unfamiliar files, and rotate credentials. Zyxel GS1900 owners should remove management interfaces from public internet exposure, replace any factory-default credentials, and apply firmware patches as they become available.